802.1x

Enable or disable 802.1x globally.

Auth Protocol

Select the 802.1x authentication protocol.

PAP: The 802.1x authentication system uses EAP packets to exchange information between the switch and the client. The transmission of EAP (Extensible Authentication Protocol) packets is terminated at the switch and the EAP packets are converted to other protocol (such as RADIUS) packets, and transmitted to the authentication server.

EAP: The 802.1x authentication system uses EAP packets to exchange information between the switch and the client. The EAP packets with authentication data are encapsulated in the advanced protocol (such as RADIUS) packets, and transmitted to the authentication server.

Accounting

Enable or disable 802.1x accounting feature.

Handshake

Enable or disable the Handshake feature. The Handshake feature is used to detect the connection status between the TP-Link 802.1x Client and the switch. Please disable Handshake feature if you are using other client softwares instead of TP-Link 802.1x Client.

VLAN Assignment

Enable or disable the 802.1x VLAN assignment feature. 802.1x VLAN assignment is a technology allowing the RADIUS server to send the VLAN assignment to the port when the port is authenticated.

If the assigned VLAN does not exist on the switch, the switch will create the related VLAN automatically, add the authenticated port to the VLAN and change the PVID based on the assigned VLAN.

If the assigned VLAN exists on the switch, the switch will directly add the authenticated port to the related VLAN and change the PVID instead of creating a new VLAN.

If no VLAN is supplied by the RADIUS server or if 802.1x authentication is disabled, the port will be in its original VLAN after successful authentication.

Status

Enable 802.1x authentication on the port.

MAB

Select whether to enable the MAB (MAC-Based Authentication Bypass) feature for the port.

With MAB feature enabled, the switch automatically sends the authentication server a RADIUS access request frame with the client’s MAC address as the username and password. It is also necessary to configure the RADIUS server with the client’s information for authentication. You can enable this feature on IEEE 802.1x ports connected to devices without 802.1x capability. For example, most printers, IP phones and fax machines do not have 802.1x capability.

Note: MAB cannot work if Guest VLAN is enabled.

Guest VLAN

Specify a Guest VLAN ID. 0 means that Guest VLAN is disabled. The configured VLAN must be an existing 802.1Q VLAN.

With Guest VLAN enabled, a port can access resources in the guest VLAN even though the port is not yet authenticated; if guest VLAN is disabled and the port is not authenticated, the port cannot visit any resource in the LAN.

Port Control

Select the control mode for the port. By default, it is Auto.

Auto: If this option is selected, the port can access the network only when it is authenticated.

Force-Authorized: If this option is selected, the port can access the network without authentication.

Force-Unauthorized: If this option is selected, the port can never be authenticated.

Port Method

Select the port method. By default, it is MAC Based.

MAC Based: All clients connected to the port need to be authenticated.

Port Based: If a client connected to the port is authenticated, other clients can access the LAN without authentication.

Maximum Request

(1-9)

Specify the maximum number of attempts to send the authentication packet. It ranges from 1 to 9 times and the default is 3 times.

Quiet Period

(1-999)

Specify the Quiet Period. It ranges from 1 to 999 seconds and the default time is 10 seconds.

The quiet period starts after the authentication fails. During the quiet period, the switch does not process authentication requests from the same client.

Supplicant Timeout

(1-9)

Specify the maximum time which the switch waits for a response from the client. It ranges from 1 to 9 seconds and the default time is 3 seconds.

If the switch does not receive any reply from the client within the specified time, it will resend the request.

Authorized

Displays whether the port is authorized or not.

LAG

Displays the LAG the port belongs to.

Port

Displays the port number.

MAC Address

Displays the MAC address of the authenticated device. When the port method is Port Based, the MAC address of the first authenticated device wil be displayed with a suffix “p”.

PAE State

Displays the current state of the authenticator PAE state machine. Possible values are: Initialize, Disconnected, Connecting, Authenticating, Authenticated, Aborting, Held, ForceAuthorized and ForceUnauthorized.

Backend State

Displays the current state of the backend authentication state machine. Possible values are: Request, Response, Success, Fail, Timeout, Initialize and Idle.

Status

Displays whether the port is authorized or not.

VID

Displays the VLAN ID assigned by the authenticator to the supplicant device when the related port is authorized. If the related port is unauthorized and there is a Guest VLAN ID, the Guest VLAN ID will be displayed.

Step 1

configure

Enter global configuration mode.

Step 2

radius-server host ip-address [ auth-port port-id ] [ acct-port port-id ] [ timeout time ] [ retransmit number ] [ nas-id nas-id ] key { [ 0 ] string | 7 encrypted-string }

Add the RADIUS server and configure the related parameters as needed.

host ip-address: Enter the IP address of the server running the RADIUS protocol.

auth-port port-id: Specify the UDP destination port on the RADIUS server for authentication requests. The default setting is 1812.

acct-port port-id: Specify the UDP destination port on the RADIUS server for accounting requests. The default setting is 1813. Generally, the accounting feature is not used in the authentication account management.

timeout time: Specify the time interval that the switch waits for the server to reply before resending. The valid values are from 1 to 9 seconds and the default setting is 5 seconds.

retransmit number: Specify the number of times a request is resent to the server if the server does not respond. The valid values are from 1 to 3 and the default setting is 2.

nas-id nas-id: Specify the name of the NAS (Network Access Server) to be contained in RADIUS packets for identification. It ranges from 1 to 31 characters. The default value is the MAC address of the switch. Generally, the NAS indicates the switch itself.

key { [ 0 ] string | 7 encrypted-string }: Specify the shared key. 0 and 7 prevent the encryption type. 0 indicates that an unencrypted key will follow. 7 indicates that a symmetric encrypted key with a fixed length will follow. By default, the encryption type is 0. string is the shared key for the switch and the server, which contains 31 characters at most. encrypted-string is a symmetric encrypted key with a fixed length, which you can copy from the configuration file of another switch. The key or encrypted-key you configured here will be displayed in the encrypted form.

Step 3

aaa group radius group-name

Create a RADIUS server group.

radius: Specify the group type as radius.

group-name: Specify a name for the group.

Step 4

server ip-address

Add the existing servers to the server group.

ip-address: Specify IP address of the server to be added to the group.

Step 5

exit

Return to global configuration mode.

Step 6

aaa authentication dot1x default { method }

Select the RADIUS group for 802.1x authentication.

method: Specify the RADIUS group for 802.1x authentication.

aaa accounting dot1x default { method }

Select the RADIUS group for 802.1x accounting.

method: Specify the RADIUS group for 802.1x accounting.

Note: If multiple RADIUS servers are available, you are suggested to add them to different server groups respectively for authentication and accounting.

Step 7

show radius-server

(Optional) Verify the configuration of RADIUS server.

Step 8

show aaa group [ group-name ]

(Optional) Verify the configuration of server group.

Step 9

show aaa authentication dot1x

(Optional) Verify the authentication method list.

Step 10

show aaa accounting dot1x

(Optional) Verify the accounting method list.

Step 11

end

Return to privileged EXEC mode.

Step 12

copy running-config startup-config

Save the settings in the configuration file.

Step 1

configure

Enter global configuration mode.

Step 2

dot1x system-auth-control

Enable 802.1x authentication globally.

Step 3

dot1x auth-protocol { pap | eap }

Configure the 802.1x authentication protocol.

pap: Specify the authentication protocol as PAP. If this option is selected, the 802.1x authentication system uses EAP (Extensible Authentication Protocol) packets to exchange information between the switch and the client. The transmission of EAP packets is terminated at the switch and the EAP packets are converted to other protocol (such as RADIUS) packets, and transmitted to the authentication server.

eap: Specify the authentication protocol as EAP. If this option is selected, the 802.1x authentication system uses EAP packets to exchange information between the switch and the client. The EAP packets with authentication data are encapsulated in the advanced protocol (such as RADIUS) packets, and transmitted to the authentication server.

Step 4

dot1x accounting

(Optional) Enable the accounting feature.

Step 5

dot1x handshake

(Optional) Enable the Handshake feature. The Handshake feature is used to detect the connection status between the TP-Link 802.1x Client and the switch. Please disable Handshake feature if you are using other client softwares instead of TP-Link 802.1x Client.

Step 6

dot1x vlan-assignment

(Optional) Enable or disable the 802.1x VLAN assignment feature. 802.1x VLAN assignment is a technology allowing the RADIUS server to send the VLAN assignment to the port when the port is authenticated.

If the assigned VLAN does not exist on the switch, the switch will create the related VLAN automatically, add the authenticated port to the VLAN and change the PVID based on the assigned VLAN.

If the assigned VLAN exists on the switch, the switch will directly add the authenticated port to the related VLAN and change the PVID instead of creating a new VLAN.

If no VLAN is supplied by the RADIUS server or if 802.1x authentication is disabled, the port will be in its original VLAN after successful authentication.

Step 7

show dot1x global

(Optional) Verify global configurations of 802.1x.

Step 8

end

Return to privileged EXEC mode.

Step 9

copy running-config startup-config

Save the settings in the configuration file.

Step 1

configure

Enter global configuration mode.

Step 2

interface {fastEthernet port | range fastEthernet port-list | gigabitEthernet port | range gigabitEthernet port-list | ten-gigabitEthernet port | range ten-gigabitEthernet port-list }

Enter interface configuration mode.

port: Enter the ID of the port to be configured.

Step 3

dot1x

Enable 802.1x authentication for the port.

Step 4

dot1x mab

Enable the MAB (MAC-Based Authentication Bypass) feature for the port.

With MAB feature enabled, the switch automatically sends the authentication server a RADIUS access request frame with the client’s MAC address as the username and password. It is also necessary to configure the RADIUS server with the client’s information for authentication. You can enable this feature on IEEE 802.1x ports connected to devices without 802.1x capability. For example, most printers, IP phones and fax machines do not have 802.1x capability.

Note: MAB cannot work if Guest VLAN is enabled.

Step 5

dot1x guest-vlan vid

(Optional) Configure guest VLAN on the port.

vid: Specify the ID of the VLAN to be configured as the guest VLAN. The valid values are from 0 to 4094. 0 means that Guest VLAN is disabled on the port. The configured VLAN must be an existing 802.1Q VLAN. Clients in the guest VLAN can only access resources from specific VLANs.

Note: To use Guest VLAN, the control type of the port should be configured as port-based.

Step 6

dot1x port-control { auto | authorized-force | unauthorized-force }

Configure the control mode for the port. By default, it is auto.

auto: If this option is selected, the port can access the network only when it is authenticated.

authorized-force: If this option is selected, the port can access the network without authentication.

unauthorized-force: If this option is selected, the port can never be authenticated.

Step 7

dot1x port-method { mac-based | port-based }

Configure the control type for the port. By default, it is mac-based.

mac-based: All clients connected to the port need to be authenticated.

port-based: If a client connected to the port is authenticated, other clients can access the LAN without authentication.

Step 8

dot1x max-req times

Specify the maximum number of attempts to send the authentication packet for the client.

times: The maximum attempts for the client to send the authentication packet. It ranges from 1 to 9 and the default is 3.

Step 9

dot1x quiet-period [time]

(Optional) Enable the quiet feature for 802.1x authentication and configure the quiet period.

time: Set a value between 1 and 999 seconds for the quiet period. It is 10 seconds by default. The quiet period starts after the authentication fails. During the quiet period, the switch does not process authentication requests from the same client.

Step 10

dot1x timeout supp-timeout time

Configure the supplicant timeout period.

time: Specify the maximum time for which the switch waits for response from the client. It ranges from 1 to 9 seconds and the default time is 3 seconds. If the switch does not receive any reply from the client within the specified time, it will resend the request.

Step 11

show dot1x interface [fastEthernet port |gigabitEthernet port | ten-gigabitEthernet port]

(Optional) Verify the configurations of 802.1x authentication on the port.

port: Enter the ID of the port to be configured. If no specific port is entered, the switch will show configurations of all ports.

Step 12

end

Return to privileged EXEC mode.

Step 13

copy running-config startup-config

Save the settings in the configuration file.

Step 1

show dot1x auth-state interface [fastEthernet port | gigabitEthernet port | tengigabitEthernet port]

Displays the authenticator state.

Step 2

configure

Enter global configuration mode.

Step 3

interface {fastEthernet port | range fastEthernet port-list | gigabitEthernet port | range gigabitEthernet port-list | ten-gigabitEthernet port | range ten-gigabitEthernet port-list}

Enter interface configuration mode.

port: Enter the ID of the port to be configured.

Step 4

dot1x auth-init [ mac mac-address ]

Initialize the specific client. To access the network, the client needs to provide the correct information to pass the authentication again.

mac-address: Enter the MAC address of the client that will be unauthorized.

Step 5

dot1x auth-reauth [ mac mac-address ]

Reauthenticate the specific client.

mac-address: Enter the MAC address of the client that will be reauthenticated.

Step 6

end

Return to privileged EXEC mode.

Step 7

copy running-config startup-config

Save the settings in the configuration file.