Install Guide

● ForceUnauthorized — an unauthorized state. A device connected to a port in this state is never subjected to the
authentication process and is not allowed to communicate on the network. Placing the port in this state is the same as
shutting down the port. Any attempt by the supplicant to initiate authentication is ignored.
● Auto — an unauthorized state by default. A device connected to this port in this state is subjected to the authentication
process. If the process is successful, the port is authorized and the connected device can communicate on the network. All
ports are placed in the Auto state by default.
To set the port state, use the following command.
● Place a port in the ForceAuthorized, ForceUnauthorized, or Auto state.
INTERFACE mode
dot1x port-control {force-authorized | force-unauthorized | auto}
The default state is auto.
The example shows configuration information for a port that has been force-authorized.
The bold line shows the new port-control state.
Re-Authenticating a Port
You can configure the authenticator for periodic re-authentication.
After the supplicant has been authenticated, and the port has been authorized, you can configure the authenticator to re-
authenticate the supplicant periodically. If you enable re-authentication, the supplicant is required to re-authenticate every 3600
seconds by default, and you can configure this interval. You can configure the maximum number of re-authentications as well.
To configure re-authentication time settings, use the following commands:
● Configure the authenticator to periodically re-authenticate the supplicant.
INTERFACE mode
dot1x reauthentication [interval] seconds
The range is from 1 to 31536000.
The default is 3600.
● Configure the maximum number of times the supplicant can be re-authenticated.
INTERFACE mode
dot1x reauth-max number
The range is from 1 to 10.
The default is 2.
The bold lines show that re-authentication is enabled and the new maximum and re-authentication time period.
Configuring Timeouts
If the supplicant or the authentication server is unresponsive, the authenticator terminates the authentication process after 30
seconds by default. You can configure the amount of time the authenticator waits for a response.
To terminate the authentication process, use the following commands:
● Terminate the authentication process due to an unresponsive supplicant.
INTERFACE mode
dot1x supplicant-timeout seconds
The range is from 1 to 300.
The default is 30.
● Terminate the authentication process due to an unresponsive authentication server.
INTERFACE mode
dot1x server-timeout seconds
The range is from 1 to 300.
The default is 30.
78
802.1X