Reference Guide

Dell PowerConnect ArubaOS 5.0 Command Line Interface | Reference Guide aaa authentication dot1x | 17
inner-eap-type
eap-gtc|eap-
mschapv2
When EAP-PEAP is the EAP method, one of the following inner EAP
types is used:
EAP-Generic Token Card (GTC): Described in RFC 2284, this EAP
method permits the transfer of unencrypted usernames and
passwords from client to server. The main uses for EAP-GTC are one-
time token cards such as SecureID and the use of LDAP or RADIUS
as the user authentication server. You can also enable caching of
user credentials on the controller as a backup to an external
authentication server.
EAP-Microsoft Challenge Authentication Protocol version 2 (MS-
CHAPv2): Described in RFC 2759, this EAP method is widely supported
by Microsoft clients.
eap-gtc/
eap-
mschapv2
eap-mschap
v2
token-caching-
period <hours>
If you select EAP-GTC as the inner EAP method, you can specify the
timeout period, in hours, for the cached information.
(any) 24 hours
timer Sets timer options for 802.1x authentication:
idrequest-
period
<seconds>
Interval, in seconds, between identity request retries. 1-65535 30 seconds
mkey-rotation-
period
<seconds>
Interval, in seconds, between multicast key rotation. 60-864000 1800 seconds
quiet-period
<seconds>
Interval, in seconds, following failed authentication. 1-65535 30 seconds
reauth-period
<seconds>
Interval, in seconds, between reauthentication attempts, or specify
server to use the server-provided reauthentication period.
60-864000 86400
seconds
(1 day)
ukey-rotation-
period
<seconds>
Interval, in seconds, between unicast key rotation. 60-864000 900 seconds
wpa-groupkey
-delay
<milliseconds>
Interval, in milliseconds, between unicast and multicast key
exchanges.
0-2000 0 ms
(no delay)
wpa-key-period
<milliseconds>
Interval, in milliseconds, between each WPA key exchange. 1000-5000 3000 ms
wpa2-key-delay
<milliseconds>
Set the delay between EAP-Success and unicast key exchange. 1-2000 0 ms
(no delay)
tls-guest-access Enables guest access for EAP-TLS users with valid certificates. — disabled
tls-guest-role
<role>
User role assigned to EAP-TLS guest.
NOTE: This parameter requires the PEFNG license.
— guest
unicast-
keyrotation
Enables unicast key rotation. — disabled
use-session-key Use RADIUS session key as the unicast WEP key. — disabled
use-static-key Use static key as the unicast/multicast WEP key. — disabled
validate-pmkid When opp-key-caching is enabled, this option instructs the controller
to check the pairwise master key (PMK) ID sent by the client. When
this option is enabled, the client must send a PMKID in the associate
or reassociate frame to indicate that it supports OKC; otherwise, full
802.1x authentication takes place. (This feature is optional, since
most clients that support OKC do not send the PMKID in their
association request.)
— disabled
Parameter Description Range Default