Configuring 802.1X Interface Settings (CLI Procedure)

 

IEEE 802.1X authentication provides network edge security, protecting Ethernet LANs from unauthorized user access by blocking all traffic to and from a supplicant (client) at the interface until the supplicant's credentials are presented and matched on the authentication server (a RADIUS server). When the supplicant is authenticated, the switch stops blocking access and opens the interface to the supplicant.

Note

Before you begin, specify the RADIUS server or servers to be used as the authentication server. See Specifying RADIUS Server Connections on Switches (CLI Procedure).

To configure 802.1X on an interface:

  1. Configure the supplicant mode as single (authenticates the first supplicant), single-secure (authenticates only one supplicant), or multiple (authenticates multiple supplicants):
    [edit protocols dot1x]

    user@switch# set authenticator interface interface-name supplicant multiple
  2. Enable reauthentication and specify the reauthentication interval:
    [edit protocols dot1x]

    user@switch# set authenticator interface interface-name reauthentication interval seconds
  3. Configure the interface timeout value for the response from the supplicant:
    [edit protocols dot1x]

    user@switch# set authenticator interface interface-name supplicant-timeout seconds
  4. Configure the timeout for the interface before it resends an authentication request to the RADIUS server:
    [edit protocols dot1x]

    user@switch# set authenticator interface interface-name server-timeout seconds
  5. Configure how long, in seconds, the interface waits before retransmitting the initial EAPOL PDUs to the supplicant:
    [edit protocols dot1x]

    user@switch# set authenticator interface interface-name transmit-period seconds
  6. Configure the maximum number of times an EAPOL request packet is retransmitted to the supplicant before the authentication session times out:
    [edit protocols dot1x]

    user@switch# set authenticator interface interface-name maximum-requests number
  7. Configure the number of times the switch attempts to authenticate the port after an initial failure. The port remains in a wait state during the quiet period after the authentication attempt.
    [edit protocols dot1x]

    user@switch# set authenticator interface interface-name retries number
Note

This setting specifies the number of attempts before the switch puts the interface in a HELD state.