Dot1X Auth-Fail Vlan - H3C MSR Series Command Reference Manual

Parameters
chap: Configures the access device to perform Extensible Authentication Protocol (EAP) termination
and use the Challenge Handshake Authentication Protocol (CHAP) to communicate with the
RADIUS server.
eap: Configures the access device to relay EAP packets, and supports any of the EAP authentication
methods to communicate with the RADIUS server.
pap: Configures the access device to perform EAP termination and use the Password Authentication
Protocol (PAP) to communicate with the RADIUS server.
Usage guidelines
The access device terminates or relays EAP packets.
•
In EAP termination mode—The access device re-encapsulates and sends the authentication
data from the client in standard RADIUS packets to the RADIUS server. The device performs
either CHAP or PAP authentication with the RADIUS server. In this mode the RADIUS server
supports only MD5-Challenge EAP authentication, and the username and password EAP
authentication initiated by an iNode client.
PAP transports usernames and passwords in plain text. The authentication method applies

to scenarios that do not require high security. To use PAP, the client can be an H3C iNode
802.1X client.
CHAP transports username in plaintext and encrypted password over the network. CHAP is

more secure than PAP.
•
In EAP relay mode—The access device relays EAP messages between the client and the
RADIUS server. The EAP relay mode supports multiple EAP authentication methods, such as
MD5-Challenge, EAP-TL, and PEAP. To use this mode, make sure the RADIUS server meets
the following requirements:
Supports the EAP-Message and Message-Authenticator attributes.

Uses the same EAP authentication method as the client.

If this mode is used, the user-name-format command configured in RADIUS scheme view
does not take effect. For more information about the user-name-format command, see
"RADIUS commands."
If RADIUS authentication is used, you must configure the access device to use the same
authentication method (PAP, CHAP, or EAP) as the RADIUS server.
Examples
# Enable the access device to terminate EAP packets and perform PAP authentication with the
RADIUS server.
<Sysname> system-view
[Sysname] dot1x authentication-method pap
Related commands
display dot1x

dot1x auth-fail vlan

Use dot1x auth-fail vlan to configure an 802.1X Auth-Fail VLAN on a port.
Use undo dot1x auth-fail vlan to restore the default.
Syntax
dot1x auth-fail vlan authfail-vlan-id
undo dot1x auth-fail vlan
165