Alcatel-Lucent 7750 Configuration Manual page 48

Port Features
802.1x Tunneling
Tunneling of untagged 802.1x frames received on a port is supported for both Epipe and VPLS
service using either null or default SAPs (for example 1/1/1:*) when the port dot1x port-control is
set to force-auth.
When tunneling is enabled on a port (using the command configure port port-id ethernet dot1x
tunneling), untagged 802.1x frames are treated like user frames and are switched into Epipe or
VPLS services which have a corresponding null SAP or default SAP on that port. In the case of a
default SAP, it is possible that other non-default SAPs are also present on the port. Untagged
802.1x frames received on other service types, or on network ports, are dropped. This is supported
on FP2 or higher hardware.
When tunneling is required, it is expected that it is enabled on all ports into which 802.1x frames
are to be received. The configuration of dot1x must be configured consistently across all ports in
LAG as this is not enforced by the system.
Note that 802.1x frames are treated like user frames, that is, tunneled, by default when received on
a spoke or mesh SDP.
802.1x Configuration and Limitations
Configuration of 802.1x network access control on the router consists of two parts:
•
•
801.x authentication:
•
•
•
Page 48
Generic parameters, which are configured under config>security>dot1x
Port-specific parameters, which are configured under config>port>ethernet>dot1x
Provides access to the port for any device, even if only a single client has been
authenticated.
Can only be used to gain access to a pre-defined Service Access Point (SAP). It is not
possible to dynamically select a service (such as a VPLS service) depending on the 802.1x
authentication information.
If 802.1x access control is enabled and a high rate of 802.1x frames are received on a port,
that port will be blocked for a period of 5 minutes as a DOS protection mechanism.
7750 SR Interface Configuration Guide