Users Guide

Security Commands 999
• force-unauthorized — Denies all access through this interface by forcing
the port to transition to the unauthorized state, ignoring all attempts by
the client to authenticate. The switch cannot provide authentication
services to the client through the interface. VLAN assignment is not
supported in this mode.
• mac-based — Enables 802.1x authentication on the interface and allows
multiple hosts to individually authenticate on a single port. The hosts are
distinguished by their MAC addresses and each host must authenticate
independently. VLAN assignment per host is allowed on the port if it is
configured in General mode.
Default Configuration
The default port-control mode is auto.
Command Mode
Interface Configuration (Ethernet) mode
User Guidelines
It is recommended that you disable spanning tree or enable spanning-tree
portfast mode on 802.1x edge ports (ports in auto state that are connected to
end stations) in order to go immediately to the forwarding state after
successful authentication.
When configuring a port to use MAC-based authentication, the port must be
in switchport general mode.
Example
The following command enables MAC-based authentication on port 1/0/2
console(config)# interface gigabitethernet 1/0/2
console(config-if-Gi1/0/2)# dot1x port-control mac-based
dot1x re-authenticate
Use the dot1x re-authenticate command to manually initiate a
re-authentication of all 802.1x-enabled ports or the specified 802.1x-enabled
port.