Dell PowerConnect B-RX Configuration Manual page 1050

33
Configuring 802.1x port security
When strict security mode is enabled:
•
•
•
When strict security mode is disabled:
•
•
By default, strict security mode is enabled for all 802.1x-enabled interfaces, but you can manually
disable or enable it, either globally or for specific interfaces.
To disable strict security mode globally, enter the following commands.
BigIron RX(config)# dot1x-enable
BigIron RX(config-dot1x)# no global-filter-strict-security
After you have globally disabled strict security mode on the device, you can re-enable it by entering
the following command.
BigIron RX(config-dot1x)# global-filter-strict-security
Syntax: [no] global-filter-strict-security
To disable strict security mode for a specific interface, enter commands such as the following.
BigIron RX(config)# interface e 1
BigIron RX(config-if-e10000-1)# no dot1x filter-strict-security
To re-enable strict security mode for an interface, enter the following command.
BigIron RX(config-if-e10000-1)# dot1x filter-strict-security
Syntax: [no] dot1x filter-strict-security
The output of the show dot1x and show dot1x config commands has been enhanced to indicate
whether strict security mode is enabled or disabled globally and on an interface.
974
If the Filter-ID attribute in the Access-Accept message contains a value that does not refer to
an existing filter (that is, a MAC address filter or IP ACL configured on the device), then the
client will not be authenticated, regardless of any other information in the message (for
example, if the Tunnel-Private-Group-ID attribute specifies a VLAN to which to assign the port).
If the Vendor-Specific attribute specifies the syntax for a filter, but there are insufficient system
resources to implement the filter, then the port will not be authenticated.
If the device does not have the system resources available to dynamically apply a filter to a
port, then the port will not be authenticated.
NOTE
If the Access-Accept message contains values for both the Filter-ID and Vendor-Specific
attributes, then the value in the Vendor-Specific attribute (the per-user filter) takes
precedence.
Also, if authentication for a port fails because the Filter-ID attribute referred to a non-existent
filter, or there were insufficient system resources to implement the filter, then a Syslog
message is generated.
If the Filter-ID attribute in the Access-Accept message contains a value that does not refer to
an existing filter (that is, a MAC address filter or IP ACL configured on the device), then the port
is still authenticated, but no filter is dynamically applied to it.
If the Vendor-Specific attribute specifies the syntax for a filter, but there are insufficient system
resources to implement the filter, then the port is still authenticated, but the filter specified in
the Vendor-Specific attribute is not applied to the port.
BigIron RX Series Configuration Guide
53-1002253-01