Product manual

- Auto: Grants network access to a connected device that
supports 802.1X authentication and provides valid
credentials.
- Authorized: Grants access to any devices connected to
the port(s). In this case, the devices do not have
to provide 802.1X credentials or support 802.1X
authentication. (Also termed ''Force Authorized''.)
- Unauthorized: In this state, the port blocks access to
any connected device, regardless of whether the
device provides the correct credentials and has
802.1X support.
o 'quiet-period' sets the period of time during which the
switch does not try to acquire a supplicant after a failed
authentication attempt(default 60 seconds).
o 'tx-period' sets the period of time the switch waits to
retransmit the next EAPOL PDU during an authentication
session (default 30 seconds).
o 'server-timeout' sets the period of time after which the
switch assumes that authentication has timed out
(default 30 seconds).
o 'supp-timeout' sets the period of time after which the
switch decides that a supplicant has not responded to an EAP
request (default 30 seconds).
o 'max-requests' sets maximum number of times the switch
retransmits a request to the backend authentication system
(RADIUS server) before closing the current authentication
session (default 2).
o 'reauth-period' sets the period of time after which connected
clients must be re-authenticated. When the timeout
is set to 0 the re-authentication is disabled (default 0
seconds).
o 'auth-vid' congures the VLAN to which to move port after
successful authentication. RADIUS server can override the
value. Use 'no' form of the command to set this PVID to 0.
If the PVID set to 0 no PVID changes occure unless RADIUS
server requests. Changes take effect after client
reauthentication. The default is 0.
o 'unauth-vid' congures the VLAN to which to move port if
an unauthorized client has been connected on the port and
there is no other client on the port. The switch will wait
for the amount of time specied as the 'unauth-period'
before the port will be moved to this VLAN. If the port PVID
successfully set to the value congured, the port becomes
unblocked and the client can communicate to other members
of this VLAN. Use 'no' form of the command to set this PVID
to 0. Changes take effect immediately. The default is 0.
o 'unauth-period' sets period of time the switch waits for
authentication before assigning the 'unauth-vid' to the port
if an unauthenticated client has been detected on this port.
The default is 0 seconds.
29© 2008 Hewlett-Packard Development Company, L.P.
aaaCommand Line Interface Reference Guide