Huawei Quidway S3900 series Command Manual page 525

Command Manual – 802.1x
Quidway S3900 Series Ethernet Switches-Release 1510
trap: Sends Trap packets if a supplicant system logs in through a proxy or through
multiple network cards.
interface-list: Ethernet port list. You can specify multiple Ethernet ports by providing this
argument in the form of interface-list = { interface-name [ to interface- name] & < 1-10 >.
The interface-name argument is the port index of an Ethernet port and can be specified
in this form: interface-name = { interface-type interface-num }, in which, interface-type
specifies the type of a port and interface-num identifies the port number. Note that the
interface name after the keyword to must have an interface-num that is greater than or
equal to that of the interface-name before the to keyword. &<1-10> means that up to 10
port indexes/port index lists can be provided.
Description
Use the dot1x supp-proxy-check command to enable 802.1X client checking for
specified ports.
Use the undo dot1x supp-proxy-check command to disable 802.1X client checking
for specified ports.
By default, 802.1X client checking is disabled for all Ethernet ports.
In system view, execution of the dot1x supp-proxy-check command enables the
supplicant system proxy checking function for specified ports if the interface-list
argument is provided; in Ethernet port view, the interface-list argument is not needed,
only the current port can have the function.
In system view, after enabling global supplicant proxy checking, you also need to
enable this function on specific ports for the function to take effect on these ports.
802.1x proxy checking checks for:
Supplicant systems logging in through proxies
Supplicant systems logging in through IE proxies
Whether or not a supplicant system logs in through multiple network cards (that is,
when supplicant system attempts to log in, it contains more than one active
network cards)
A switch may take the following actions in response to any of the above three cases:
Disconnects the supplicant system and sends Trap packets (using the dot1x
supp-proxy-check logoff command.)
Sends Trap packets without disconnecting the supplicant system (using the dot1x
supp-proxy-check trap command.)
This function needs the support of 802.1x clients and CAMS:
The 802.1x supplicant system must be able to detect whether the client uses
multiple network cards, a proxy, or IE proxy;
CAMS has disabled the use of multiple network cards, a proxy server, and an IE
proxy server.
Huawei Technologies Proprietary
1-16
Chapter 1 802.1x Configuration Commands