D-Link DWS-1008 Cli Reference Manual page 138

DWS-1008 CLI Reference Guide
If you specify multiple authentication methods in the set authentication dot1x command,
MSS applies them in the order in which they appear in the command, with these results:
• If the first method responds with pass or fail, the evaluation is final.
• If the first method does not respond, MSS tries the second method, and so on.
• However, if local appears first, followed by a RADIUS server group, MSS overrides
any failed searches in the local database and sends an authentication request to
the server group.
If the user does not support 802.1X, MSS attempts to perform MAC authentication for the
user. In this case, if the switch's configuration contains a set authentication mac command
that matches the SSID the user is attempting to access and the user's MAC address, MSS
uses the method specified by the command. Otherwise, MSS uses local MAC authentication
by default.
If the username does not match an authentication rule for the SSID the user is attempting
to access, MSS uses the fallthru authentication type configured for the SSID, which can be
last-resort or none.
Examples: The following command configures EAP-TLS authentication in the local database
DWS-1008# set authentication dot1x ssid mycorp Geetha eap-tls local
success: change accepted.
The following command configures PEAP-MS-CHAP-V2 authentication at RADIUS server
groups sg1 through sg3 for all 802.1X clients at example.com who want to access SSID
examplecorp:
DWS-1008# set authentication dot1x ssid examplecorp *@example.com
peap-mschapv2 sg1 sg2 sg3
success: change accepted.
set authentication last-resort
Configures an authentication rule to grant network access to a user who is not otherwise
granted or denied access by 802.1X, or granted access by MAC authentication.
Syntax: set authentication last-resort {ssid ssid-name | wired}
method1 [method2] [method3] [method4]
ssid ssid-name
wired
D-Link Systems, Inc.
for SSID mycorp and 802.1X client Geetha:
SSID name to which this authentication rule applies. To apply the rule to
all SSIDs, type any.
Applies this authentication rule specifically to users connected to a wired
authentication port.
AAA Commands
137