H3C Technologies H3C S6300 Series Switches - Manual (Page 92)

77
Task Command
Display 802.1X session information, statistics,
or configuration information of specified or all
ports.
display dot1x [ sessions | statistics ] [ interface interface-type
interface-number ]
Clear 802.1X statistics.
reset dot1x statistics [ interface interface-type
interface-number ]
802.1X authentication configuration example
Network requirements
As shown in Figure 30 , the access device performs 802.1X authentication for users that connect to port
Ten-GigabitEthernet 1/0/1. Implement MAC-based access control on the port, so the logoff of one user
does not affect other online 802.1X users.
Use RADIUS servers to perform authentication, authorization, and accounting for the 802.1X users. If
RADIUS authentication fails, perform local authentication on the access device.
Configure the host at 10.1.1.1/24 as the primary authentication and accounting servers, and the host at
10.1.1.2/24 as the secondary authentication and accounting servers. Assign all users to the ISP domain
bbb.
Configure the shared key as name for packets between the access device and the authentication server,
and the shared key as money for packets between the access device and the accounting server.
Figure 30 Network diagram
Configuration procedure
1. Configure the 802.1X client. If H3C iNode is used, do not select the Carry version info option in
the client configuration. (Details not shown.)
2. Configure the RADIUS servers and add user accounts for the 802.1X users. (Details not shown.)
For information about the RADIUS commands used on the access device in this example, see
Security Command Reference.
3. Assign an IP address for each interface on the access device. (Details not shown.)
4. Configure user accounts for the 802.1X users on the access device:
Internet
Device
Authenticator
Host
192.168.1.2/24
XGE1/0/1
Vlan-int2
192.168.1.1/24
RADIUS server cluster
Primary: 10.1.1.1/24
Secondary: 10.1.1.2/24
Supplicant
XGE1/0/2
10.1.1.10/24