404 CHAPTER 39: 802.1X CONFIGURATIONConfigurationExample802.1x ConfigurationExampleNetwork requirements■ Authenticate users on all ports to control their accesses to the Internet. Theswitch operates in MAC address-based access control mode. The access controlmode is MAC-address-based.■ All supplicant systems that pass the authentication belong to the defaultdomain named “aabbcc.net”. The domain can accommodate up to 30 users.As for authentication, a supplicant system is authenticated locally if the RADIUSserver fails. And as for accounting, a supplicant system is disconnected by forceif the RADIUS server fails. The name of an authenticated supplicant system isnot suffixed with the domain name. A connection is terminated if the total sizeof the data passes through it during a period of 20 minutes is less than 2,000bytes. All connected clients belong to the same default domain: aabbcc.net,which accommodates up to 30 clients. Authentication is performed either onthe RADIUS server, or locally (in case that the RADIUS server fails to respond). Aclient is disconnected in one of the following two situations: RADIUSaccounting fails; the connected user has not included the domain name in theusername, and there is a continuous below 2000 bytes of traffic for over 20minutes.■ The switch is connected to a server comprising of two RADIUS servers whose IPaddresses are 10.1.1.1 and 10.1.1.2. The RADIUS server with an IP address of10.1.1.1 operates as the primary authentication server and the secondaryaccounting server. The other operates as the secondary authentication serverand primary accounting server. The password for the switch and theauthentication RADIUS servers to exchange message is “name”. And thepassword for the switch and the accounting RADIUS servers to exchangemessage is “money”. The switch sends another packet to the RADIUS serversagain if it sends a packet to the RADIUS server and does not receive responsefor 5 seconds with a maximum number of retries of 5. And the switch sends areal-time accounting packet to the RADIUS servers once in every 15 minutes. Auser name is sent to the RADIUS servers with the domain name truncated.Connected to the switch is a server group comprised of two RADIUS serverswhose IP addresses are 10.1.1.1 and 10.1.1.2 respectively, with the formerbeing the primary authentication and the secondary counting server, and thelatter the secondary authentication and the primary counting server. Configurethe interaction password between the switch and the authenticating RADIUSserver to be “name”, and “money” for interaction between the switch and thecounting RADIUS. Configure the waiting period for the switch to resendpackets to the RADIUS server to be 5 seconds, that is, if after 5 seconds theRADIUS still has not sent any responses back, the switch will resend packets.Table 324 Display and debug 802.1xOperation Command DescriptionDisplay the configuration,session, and statisticsinformation about 802.1xdisplay dot1x [ sessions |statistics ] [ interfaceinterface-list ]You can execute the displaycommand in any viewClear 802.1x-related statisticsinformationreset dot1x statistics[ interface interface-list ]You can execute the resetcommand in user view
