Configuration Prerequisites - H3C S5120-HI Security Configuration Manual

Authentication status
A user in the 802.1X critical VLAN fails
authentication because all the RADIUS
servers are unreachable.
A user in the critical VLAN fails 802.1X
authentication for any other reason than
server unreachable.
A user in the critical VLAN passes 802.1X
authentication.
A user in the 802.1X guest VLAN or the
Auth-Fail VLAN fails authentication because
all the RADIUS server are unreachable.
A user in the MAC authentication guest
VLAN fails 802.1X authentication because
all the 802.1X authentication server are
unreachable.
NOTE:
The network device assigns a hybrid port to an 802.1X critical VLAN as an untagged member.
Any of the following RADIUS authentication server changes in the ISP domain for 802.1X users on a port
can cause the users to be removed from the critical VLAN:
• An authentication server is added to the ISP domain and the server is reachable.
A response from a RADIUS authentication server is received.
•
The RADIUS server probing function detects that a RADIUS authentication server is reachable.
•
You can use the dot1x critical recovery-action reinitialize command to configure the port to trigger
802.1X re-authentication when the port or an 802.1X user on the port is removed from the critical VLAN.
If MAC-based access control is used, the port sends a unicast Identity EAP/Request to the 802.1X
•
user to trigger authentication.
• If port-based access control is used, the port sends a multicast Identity EAP/Request to the 802.1X
users to trigger authentication.
ACL assignment
You can specify an ACL for an 802.1X user to control its access to network resources. After the user
passes 802.1X authentication, the authentication server, either the local access device or a RADIUS
server, assigns the ACL to the port to filter the traffic from this user. In either case, you must configure the
ACL on the access device. You can change ACL rules while the user is online.

Configuration prerequisites

Configure an ISP domain and AAA scheme (local or RADIUS authentication) for 802.1X users.
•
VLAN manipulation
The user is still in the critical VLAN.
If an Auth-Fail VLAN has been configured, re-maps the MAC
address of the user to the Auth-Fail VLAN ID.
Re-maps the MAC address of the user to the server-assigned
VLAN.
If the authentication server assigns no VLAN, re-maps the MAC
address of the user to the default or user-configured PVID on the
port.
The user remains in the 802.1X VLAN or the Auth-Fail VLAN.
The user is removed from the MAC authentication VLAN and
mapped to the 802.1X critical VLAN.
81