Enabling The Quiet Timer; Enabling The Re-Authentication Function; Configuring A Guest Vlan - H3C S9500E Series Security Configuration Manual

Enabling the quiet timer

After the quiet timer is enabled on the switch, when a client fails 802.1X authentication, the switch
refuses further authentication requests from the client in a period of time, which is specified by the
quiet timer (using the dot1x timer quiet-period command).
Follow these steps to enable the quiet timer:
To do...
1. Enter system view
2. Enable the quiet timer

Enabling the re-authentication function

If periodic re-authentication is enabled on a port, the switch will re-authenticate online users on the
port at the interval specified by the periodic re-authentication timer. This is intended to track the
connection status of online users and update the authorization attributes assigned by the server,
such as the VLAN and QoS Profile, ensuring that the users are in normal online state.
Follow these steps to enable the periodic re-authentication function:
To do...
1. Enter system view
2. Enter Ethernet interface view
3. Enable periodic re-
authentication
After an 802.1X user passes authentication, if the authentication server assigns a re-authentication interval
•
for the user through the session-timeout attribute, the assigned re-authentication interval will take effect
instead of that specified on the switch. The re-authentication interval assignment varies by server type. For
more information, see the specific authentication server implementation.
VLAN information assigned to the same user before and after re-authentication can be different.
•
However, if the server assigns VLAN information before re-authentication, it must assign that information
after re-authentication; if the server assigns no VLAN information before re-authentication, it cannot
assign that information after re-authentication.

Configuring a guest VLAN

If the traffic from a user-side switch carries VLAN tags and the 802.1X authentication and guest VLAN
•
functions are configured on the access port, it is recommended to configure different VLAN IDs for the
default VLAN of the port, and 802.1X guest VLAN. This is to ensure the normal use of the functions.
Use the command...
system-view
dot1x quiet-period
Use the command...
system-view
interface interface-type interface-
number
dot1x re-authenticate
80
Remarks
—
Required
Disabled by default
Remarks
—
—
Required
Disabled by default