dot1x port-control

Controls port-state authorization and configures the port control type to activate authentication on an 802.1X-enabled interface.

Syntax

dot1x port-control { auto | force-authorized | force-unauthorized }

no dot1x port-control { auto | force-authorized | force-unauthorized }

Command Default

The default port state is auto.

Parameters

auto: Enables authentication on a port. It places the controlled port in the unauthorized state until authentication takes place between the client and authentication server. Once the client passes authentication, the port becomes authorized. This activates authentication on an 802.1X-enabled interface. The controlled port remains in the authorized state until the Client logs off.

force-authorized: Places the controlled port unconditionally in the authorized state, allowing all traffic to pass between the client and the authenticator. This also allows connection from multiple clients.

force-unauthorized: Places the controlled port unconditionally in the unauthorized state, denying any traffic to pass between the client and the authenticator.

Modes

Interface subtype configuration mode

Usage Guidelines

Before activating the authentication using the dot1x port-control auto command on a port, you must remove the configured static ACL and static VLANs, if any, from the port.

802.1x port authentication is not supported by LAG (Link Aggregation Group) or interfaces that participate in a LAG.

The no form of the command resets the port control type to the default state.

Examples

The following example configures the interface to place the port unconditionally in the unauthorized state until authentication takes place between the client and authentication server. Once the client passes authentication, the port becomes authorized.

device(config)# interface Ethernet 1/1
device(conf-if-eth-1/1)# dot1x port-control auto

The following example configures the interface to place the controlled port unconditionally in the authorized state.

device(config)# interface Ethernet 1/1
device(conf-if-eth-1/1)# dot1x port-control force-authorized

The following example configures the interface to place the controlled port unconditionally in the unauthorized state.

device(config)# interface Ethernet 1/1
device(conf-if-eth-1/1)# dot1x port-control force-unauthorized