ii
802.1X client as the initiator································································································································ 81
Access device as the initiator······························································································································· 82
802.1X authentication procedures ······························································································································ 82
A comparison of EAP relay and EAP termination······························································································ 83
EAP relay································································································································································ 83
EAP termination ····················································································································································· 86
Configuring 802.1X ··················································································································································87
H3C implementation of 802.1X··································································································································· 87
Access control methods ········································································································································ 87
Using 802.1X authentication with other features ······························································································ 87
Configuration prerequisites··········································································································································· 92
802.1X configuration task list······································································································································· 93
Enabling 802.1X···························································································································································· 93
Configuration guidelines ······································································································································ 93
Configuration procedure ······································································································································ 94
Enabling EAP relay or EAP termination ······················································································································· 94
Setting the port authorization state ······························································································································ 95
Specifying an access control method ·························································································································· 95
Setting the maximum number of concurrent 802.1X users on a port······································································· 96
Setting the maximum number of authentication request attempts ············································································· 96
Setting the 802.1X authentication timeout timers······································································································· 97
Configuring the online user handshake function ········································································································ 97
Configuration guidelines ······································································································································ 97
Configuration procedure ······································································································································ 98
Configuring the authentication trigger function ·········································································································· 98
Configuration guidelines ······································································································································ 98
Configuration procedure ······································································································································ 99
Specifying a mandatory authentication domain on a port························································································ 99
Configuring the quiet timer ··········································································································································· 99
Enabling the periodic online user re-authentication function···················································································100
Configuration guidelines ····································································································································100
Configuration procedure ····································································································································100
Configuring a port to send EAPOL frames untagged·······························································································101
Setting the maximum number of 802.1X authentication attempts for MAC authentication users·······················101
Configuring a VLAN group·········································································································································101
Configuring an 802.1X guest VLAN ·························································································································102
Configuration guidelines ····································································································································102
Configuration prerequisites ································································································································103
Configuration procedure ····································································································································103
Configuring an 802.1X Auth-Fail VLAN····················································································································103
Configuration guidelines ····································································································································103
Configuration prerequisites ································································································································104
Configuration procedure ····································································································································104
Configuring an 802.1X critical VLAN ·······················································································································104
Configuration guidelines ····································································································································104
Configuration prerequisites ································································································································105
Configuration procedure ····································································································································105
Specifying supported domain name delimiters·········································································································105
Displaying and maintaining 802.1X ·························································································································106
802.1X authentication configuration example ·········································································································106
Network requirements·········································································································································106
Configuration procedure ····································································································································107
Verifying the configuration·································································································································108
802.1X with guest VLAN and VLAN assignment configuration example ·····························································109
