dot1x port-control

Function

The dot1x port-control command configures an authorization mode for 802.1X authentication on an interface.

By default, the auto mode is used for 802.1x authentication.

Format

dot1x port-control { authorized-force | auto | unauthorized-force }

Parameters

Parameter	Description	Value
authorized-force	Indicates the forcible authorization mode for 802.1X authentication on an interface.	-
auto	Indicates the automatic identification mode for 802.1X authentication on an interface.	-
unauthorized-force	Indicates the forcible unauthorization mode for 802.1X authentication on an interface.	-

Parameter

Description

Value

authorized-force

Indicates the forcible authorization mode for 802.1X authentication on an interface.

auto

Indicates the automatic identification mode for 802.1X authentication on an interface.

unauthorized-force

Indicates the forcible unauthorization mode for 802.1X authentication on an interface.

Views

GE optical interface view, GE electrical interface view

Default Level

2: Configuration level

Task Name and Operations

Task Name	Operations
dot1x	write

Usage Guidelines

Usage Scenario

In normal situations, configuring the authorization mode for an 802.1X authentication-enabled interface as auto is recommended. In this mode, the interface is initially in unauthorized state and allows only users' EAPOL packets to pass through and does not allow users to access network resources. After the users pass 802.1X authentication, the interface switches to the authorized state, and the users can access network resources.
In scenarios where all users connected to an 802.1X authentication-enabled interface are trusted and granted access to the network without being authenticated, you can configure the authorization mode as authorized-force for the interface. In this mode, the interface remains in authorized state and allows users to access the network without being authorized.
In scenarios where all users connected to an interface need to be disabled from accessing network resources due to security considerations, you can configure the authorization mode as unauthorized-force for the interface. In this mode, the interface remains in unauthorized state and prohibits users from accessing network resources. To configure an authorization mode for 802.1X authentication on an interface, run the dot1x port-control command.

Prerequisites

802.1X authentication has been enabled on the interface using the dot1x enable command.

Configuration Impact

If the authorization mode of an interface is changed when users are accessing the network through this interface, the users may be logged off unexpectedly and then automatically log in, and services are interrupted during this period of time.

Precautions

In VS mode, this command is supported only by the admin VS.

Example

# Configure the authorization mode as authorized-force for 802.1X authentication on GE 0/1/1.

<HUAWEI> system-view
[~HUAWEI] interface GigabitEthernet 0/1/1
[*HUAWEI-GigabitEthernet0/1/1] dot1x enable
[*HUAWEI-GigabitEthernet0/1/1] dot1x port-control authorized-force