Dot1X Critical (Interface Configuration) - Cisco Catalyst 3550 Command Reference Manual

Chapter 2 Catalyst 3550 Switch Cisco IOS Commands

dot1x critical (interface configuration)

Use the dot1x critical interface configuration command to enable the inaccessible authentication bypass
feature, also referred to as critical authentication or the authentication, authorization, and accounting
(AAA) fail policy. You can also configure the access VLAN to which the switch assigns the critical port
when the port is in the critical-authentication state. To disable the feature or return to default, use the no
form of this command.
Syntax Description recovery action reinitialize
vlan vlan-id
Defaults The inaccessible authentication bypass feature is disabled.
The recovery action is not configured.
The access VLAN is not configured.
Command Modes
Interface configuration
Command History Release
12.2(25)SEE
Usage Guidelines To specify the access VLAN to which the switch assigns a critical port when the port is in the
critical-authentication state, use the vlan vlan-id keywords. The specified type of VLAN must match the
type of port, as follows:
•
•
•
If the client is running Windows XP and the critical port to which the client is connected is in the
critical-authentication state, Windows XP might report that the interface is not authenticated.
If the Windows XP client is configured for DHCP and has an IP address from the DHCP server, receiving
an EAP-Success message on a critical port might not re-initiate the DHCP configuration process.
You can configure the inaccessible authentication bypass feature and the restricted VLAN on an
IEEE 802.1x port. If the switch tries to re-authenticate a critical port in a restricted VLAN and all the
RADIUS servers are unavailable, the switch changes the port state to the critical authentication state,
and it remains in the restricted VLAN.
OL-8566-02
dot1x critical [recovery action reinitialize | vlan vlan-id]
no dot1x critical [recovery | vlan]
Modification
This command was introduced.
If the critical port is an access port, the VLAN must be an access VLAN.
If the criticalport is a private VLAN host port, the VLAN must be a secondary private VLAN.
If the critical port is a routed port, you can specify a VLAN but this is optional.
Enable the inaccessible-authentication-bypass recovery feature, and
specify that the recovery action is to authenticate the port when an
authentication server is available.
Specify the access VLAN to which the switch can assign a critical
port. The range is from 1 to 4094.
Catalyst 3550 Multilayer Switch Command Reference
dot1x critical (interface configuration)
2-87