1-11Checking the supplicant systemAn S5600 series switch checks:z Supplicant systems logging on through proxiesz Supplicant systems logging on through IE proxiesz Whether or not a supplicant system logs in through more than one network adapters(that is, whether or not more than one network adapters are active in a supplicantsystem when the supplicant system logs in).In response to any of the three cases, a switch can optionally take the following measures:z Only disconnects the supplicant system but sends no Trap packets.z Sends Trap packets without disconnecting the supplicant system.This function needs the cooperation of 802.1x client and a CAMS server.z The 802.1x client needs to be capable of detecting multiple network adapters, proxies,and IE proxies.z The CAMS server is configured to disable the use of multiple network adapters, proxies,or IE proxies.By default, an 802.1x client program allows use of multiple network adapters, proxies, andIE proxies. In this case, if the CAMS server is configured to disable use of multiple networkadapters, proxies, or IE proxies, it prompts the 802.1x client to disable use of multiplenetwork adapters, proxies, or IE proxies through messages after the supplicant systempasses the authentication.z The client-checking function needs the support of H3C’s 802.1x client program.z To implement the proxy detecting function, you need to enable the function on both the802.1x client program and the CAMS server in addition to enabling the client versiondetecting function on the switch by using the dot1x version-check command.Checking the client versionWith the 802.1x client version-checking function enabled, a switch checks the version andvalidity of an 802.1x client to prevent unauthorized users or users with earlier versions of802.1x client from logging in.This function makes the switch to send version-requesting packets again if the 802.1xclient fails to send version-reply packet to the switch when the version-checking timertimes out.
