Operation Manual

Port Commands

5 – 61

For 802.1X clients, wired authentication works only if the clients are directly attached to the wired

authentication port, or are attached through a hub that does not block forwarding of packets from

the client to the PAE group address (01:80:c2:00:00:03). Wired authentication works in accordance

with the 802.1X specification, which prohibits a client from sending traffic directly to an

authenticator MAC address until the client is authenticated. Instead of sending traffic to the

authenticator MAC address, the client sends packets to the PAE group address. The 802.1X

specification prohibits networking devices from forwarding PAE group address packets, because

this would make it possible for multiple authenticators to acquire the same client.

For non-802.1X clients, who use MAC authentication, WebAAA, or last-resort authentication,

wired authentication works if the clients are directly attached or indirectly attached.

Examples

The following command sets port 10 for a wired authentication user:

MX# set port type wired-auth 10

success: change accepted

Examples

The following command sets port 7 for a wired authentication user and specifies a

maximum of three simultaneous user sessions:

MX# set port type wired-auth 7 max-sessions 3

success: change accepted