Related Documentation
- EX Series
- clear dot1x
- Example: Setting Up 802.1X for Single Supplicant or Multiple Supplicant Configurations on an EX Series Switch
- Example: Configuring 802.1X Authentication Options When the RADIUS Server is Unavailable to an EX Series Switch
- Example: Configuring Fallback Options on EX Series Switches for EAP-TTLS Authentication and Odyssey Access Clients
- Filtering 802.1X Supplicants Using RADIUS Server Attributes
- Verifying 802.1X Authentication
show dot1x
Syntax
Release Information
Command introduced in Junos OS Release 9.0 for EX Series switches.
Description
Display the current operational state of all ports with the list of connected users.
This command displays the list of connected supplicants received from the RADIUS authentication server regardless of the session state—that is, for both authenticated supplicants and for supplicants that attempted authentication.
Options
none | — | Display information for all authenticator ports. |
brief | detail | — | (Optional) Display the specified level of output. |
interface interface-name | — | Display information for the specified port with a list of connected supplicants. |
Required Privilege Level
view
Related Documentation
- EX Series
- clear dot1x
- Example: Setting Up 802.1X for Single Supplicant or Multiple Supplicant Configurations on an EX Series Switch
- Example: Configuring 802.1X Authentication Options When the RADIUS Server is Unavailable to an EX Series Switch
- Example: Configuring Fallback Options on EX Series Switches for EAP-TTLS Authentication and Odyssey Access Clients
- Filtering 802.1X Supplicants Using RADIUS Server Attributes
- Verifying 802.1X Authentication
List of Sample Output
show dot1x interface briefshow dot1x interface detail
Output Fields
Table 1 lists the output fields for the show dot1x command. Output fields are listed in the approximate order in which they appear.
Table 1: show dot1x Output Fields
Field Name | Field Description | Level of Output |
|---|---|---|
Interface | Name of a port. | All levels |
MAC address | The MAC address of the connected supplicant on the port. | All levels |
Role | The 802.1X authentication role of the interface. When 802.1X is enabled on an interface, the role is Authenticator. As Authenticator, the interface blocks LAN access until a supplicant is authenticated through 802.1X or MAC RADIUS authentication. | brief, detail |
State | The state of the port:
| brief |
User | The user name of the connected supplicant | brief |
Administrative state | The administrative state of the port:
| detail |
Supplicant | The mode for the supplicant:
| detail |
Quiet period | The number of seconds the port remains in the wait state following a failed authentication exchange with the supplicant before reattempting the authentication. The default value is 60 seconds. The range is 0 through 65,535 seconds. | detail |
Transmit period | The number of seconds the port waits before retransmitting the initial EAPOL PDUs to the supplicant. The default value is 30 seconds. The range is 1 through 65,535 seconds. | detail |
MAC radius | MAC RADIUS authentication:
| detail |
MAC radius restrict | The authentication method is restricted to MAC RADIUS only. 802.1X authentication is not enabled. | detail |
Reauthentication | The reauthentication state:
| detail |
Supplicant timeout | The number of seconds the port waits for a response when relaying a request from the authentication server to the supplicant before resending the request. The default value is 30 seconds. The range is 1 through 60 seconds. | detail |
Server timeout | The number of seconds the port waits for a reply when relaying a response from the supplicant to the authentication server before timing out. The default value is 30 seconds. The range is 1 through 60 seconds. | detail |
Maximum EAPOL requests | The maximum number of retransmission times of an EAPOL request packet to the supplicant before the authentication session times out. The default value is 2. The range is 1 through 10. | detail |
Number of clients bypassed because of authentication | The number of non-802.1X clients granted access to the LAN by means of static MAC bypass. The following fields are displayed:
| detail |
Guest VLAN member | The VLAN to which a supplicant is connected when the supplicant is authenticated using a guest VLAN. If a guest VLAN is not configured on the interface, this field displays <not configured>. | detail |
Number of connected supplicants | The number of supplicants connected to a port. | detail |
Supplicant | The user name and MAC address of the connected supplicant. | detail |
Authentication method | The 802.1X authentication method used for a supplicant:
| detail |
Authenticated VLAN | The VLAN to which the supplicant is connected. | detail |
Dynamic filter | User policy filter sent by the RADIUS server. | detail |
Session Reauth interval | The configured reauthentication interval. | detail |
Reauthentication due in | The number of seconds in which reauthentication will occur again for the connected supplicant. | detail |
Sample Output
show dot1x interface brief
user@switch> show dot1x interface brief 802.1X Information: Interface Role State MAC address User ge-0/0/1 Authenticator Authenticated 00:a0:d2:18:1a:c8 user1 ge-0/0/2 Authenticator Connecting ge-0/0/3 Authenticator Held 00:a6:55:f2:94:ae user3
show dot1x interface detail
user@switch> show dot1x interface ge-0/0/16.0
detail
ge-0/0/16.0
Role: Authenticator
Administrative state: Auto
Supplicant mode: Single
Number of retries: 3
Quiet period: 60 seconds
Transmit period: 30 seconds
Mac Radius: Enabled
Mac Radius Strict: Disabled
Reauthentication: Enabled
Configured Reauthentication interval: 40 seconds
Supplicant timeout: 30 seconds
Server timeout: 30 seconds
Maximum EAPOL requests: 1
Guest VLAN member: <not configured>
Number of connected supplicants: 1
Supplicant: abc, 00:30:48:8C:66:BD
Operational state: Authenticated
Authentication method: Radius
Authenticated VLAN: v200
Reauthentication due in 17 seconds