H3C S7500 Series Ethernet Switches Command Manual

Command Manual – 802.1x
H3C S7500 Series Ethernet Switches Chapter 1
802.1x Configuration Commands
1-16
trap: Sends Trap packets if a supplicant system logs in through the proxy server or
through multiple network cards.
interface-list: Ethernet port list. You can specify multiple Ethernet ports by providing this
argument in the form of interface-list = { interface-name [ to interface- name] & < 1-10 >.
The interface-name argument is the port index of an Ethernet port and can be specified
in this form: interface-name = { interface-type interface-num }, where interface-type
specifies the type of a port and interface-num identifies the port number. "&<1-10>"
means that up to 10 port indexes/port index lists can be provided.
Description
Use the dot1x supp-proxy-check command to configure the switch to check and
control the users who log in through the proxy server.
Use the undo dot1x supp-proxy-check command to remove the configuration.
When being executed in system view, these two commands apply to all Ethernet ports
of the switch if you do not provide the interface-list argument. And if you specify the
interface-list argument, these commands apply to the specified Ethernet ports.
When being executed in Ethernet port view, these two commands apply to the current
Ethernet port only. In this case, the interface-list argument is not needed.
In system view, the configuration takes effect only after you enable the proxy detection
function globally and on the specified ports.
Proxy detection checks:
z Supplicant systems logging in through the proxy server;
z Supplicant systems logging in through the IE proxy server;
z Supplicant systems logging in through multiple network cards (that is, when a
supplicant system logs in, it contains more than one active network card).
A switch may take the following actions in response to any of the above three cases:
z Disconnects the supplicant system and sends Trap packets (using the dot1x
supp-proxy-check logoff command).
z Sends only Trap packets without disconnecting the supplicant system (using the
dot1x supp-proxy-check trap command).
This function needs the support of 802.1x clients and CAMS:
z 802.1x clients are capable of checking the supplicant system uses multiple
network cards, proxy server, or IE proxy server;
z CAMS is capable of disabling multiple network cards, proxy server, or IE proxy
server on supplicant systems.
By default, an 802.1x client disables the function of disabling multiple network adapters,
proxy server, or IE proxy server. If CAMS enables the function, it will prompt the 802.1x
client to enable the function after the supplicant system passes the authentication.