H3C S7500 Series Operation Manual page 508

Operation Manual – 802.1x
H3C S7500 Series Ethernet Switches
In response to any of the three cases, a switch can optionally take the following
measures:
Disconnects the supplicant system and sends Trap packets (using the dot1x
supp-proxy-check logoff command);
Sends Trap packets without disconnecting the supplicant system (using the dot1x
supp-proxy-check trap command).
This function needs the support of 802.1x clients and CAMS:
The 802.1x clients are capable of detecting multiple network interface cards, proxy
server, or IE proxy server.
CAMS is capable of disabling multiple network interface cards, proxy sever, or IE
proxy server on the supplicant system.
By default, an 802.1x client program disables the function of disabling multiple network
interface cards, proxy server, and IE proxy server. If CAMS enables the function, it will
prompt the 802.1x client to enable the function after the supplicant system passes the
authentication.
Note:
The proxy detection function needs the support of H3C's 802.1x client program.
The proxy detection function should be enabled on both the 802.1x client program
and CAMS. The client version checking function should be enabled on the switch
(by using the dot1x version-check command).
II. Client version checking
With the 802.1x client version checking function enabled, a switch will check the
version and validity of an 802.1x client to prevent unauthorized users or users with
earlier versions of 802.1x from logging in.
The switch will resend a version request packet if the supplicant system does not send
a version reply packet to it when the version-checking timer times out.
Note:
The client version checking function needs the support of H3C's 802.1x client program.
III. Guest VLAN
The Guest VLAN function enables supplicant systems that do not pass the
authentication to access a LAN in a restrained way.
1-11
Chapter 1 802.1x Configuration