Cisco IE-4000 Software Configuration Manual page 228

Configuring IEEE 802.1x Port-Based Authentication
How to Configure IEEE 802.1x Port-Based Authentication
Configuring Optional 802.1x Authentication Features
Command
1. dot1x reauthenticate interface
interface-id
2. authentication mac-move permit
3. authentication violation {protect |
replace | restrict | shutdown}
1. configure terminal
2. mab request format attribute 32 vlan
access-vlan
3. interface interface-id
4. authentication timer inactivity seconds
5. authentication timer reauthenticate
seconds
6. dot1x max-reauth-req count
7. dot1x max-req count
Purpose
(Optional) Manually initiates a reauthentication of the specified IEEE
802.1x-enabled port.
(Optional) Enables MAC move on the switch.
(Optional) replace—Enables MAC replace on the interface. The port
removes the current session and initiates authentication with the new
host.
The other keywords have these effects:

protect—Drops port packets with unexpected MAC addresses
without generating a system message.

restrict—Drops violating packets by the CPU and a system message
is generated.

shutdown—Error-disables the port when it receives an unexpected
MAC address.
Enters global configuration mode.
(Optional) Enables VLAN ID-based MAC authentication.
(Optional) Specifies the port to be configured, and enters interface
configuration mode.
(Optional) Sets the number of seconds that the switch remains in the quiet
state after a failed authentication exchange with the client.
The range is 1 to 65535 seconds; the default is 60.
(Optional) Sets the number of seconds that the switch waits for a
response to an EAP-request/identity frame from the client before
resending the request.
The range is 1 to 65535 seconds; the default is 5.
Note: You should change the default value of this command only to
adjust for unusual circumstances such as unreliable links or specific
behavioral problems with certain clients and authentication servers.
(Optional) Sets the number of times that the switch sends an
EAP-request/identity frame to the client before restarting the
authentication process. The range is 1 to 10; the default is 2.
Note: You should change the default value of this command only to
adjust for unusual circumstances such as unreliable links or specific
behavioral problems with certain clients and authentication servers.
(Optional) Sets the number of times that the switch restarts the
authentication process before the port changes to the unauthorized state.
The range is 0 to 10; the default is 2.
224