OLT3610-08GP4S 802.

1x CONFIGURATION COMMANDS
OLT3610 Series 802.1x Configuration Commands

OLT3610 Series
802.1x Configuration Commands

Models: OLT3610-08GP4S OLT3610-16GP4S

www.fs.com
OLT3610 Series 802.1x CONFIGURATION COMMANDS

Contents
Chapter 1 802.1x Configuration Commands.................................................................................................................................................. 1
1.1 802.1x Configuration Commands.............................................................................................................................................................. 1
1.1.1 dot1x enable .............................................................................................................................................................................................. 2
1.1.2 dot1x port-control .................................................................................................................................................................................... 2
1.1.3 dot1x authentication multiple-hosts..................................................................................................................................................... 3
1.1.4 dot1x authentication multiple-auth.......................................................................................................................................................4
1.1.5 dot1x default ..............................................................................................................................................................................................5
1.1.6 dot1x reauth-max ......................................................................................................................................................................................5
1.1.7 dot1x re-authentication ........................................................................................................................................................................... 6
1.1.8 dot1x timeout quiet-period.....................................................................................................................................................................6
1.1.9 dot1x timeout re-authperiod.................................................................................................................................................................. 7
1.1.10 dot1x timeout tx-period........................................................................................................................................................................ 7
1.1.11 dot1x timeout misc-mab-refresh..........................................................................................................................................................8
1.1.12 dot1x timeout misc-mab-aging............................................................................................................................................................ 8
1.1.13 dot1x mab................................................................................................................................................................................................ 9
1.1.14 dot1x mabformat.................................................................................................................................................................................. 10
1.1.15 dot1x user-permit ................................................................................................................................................................................. 10
1.1.16 dot1x authentication method.............................................................................................................................................................11
1.1.17 dot1x accounting enable .....................................................................................................................................................................12
1.1.18 dot1x accounting method...................................................................................................................................................................12
1.1.19 dot1x authen-type, dot1x authentication type ................................................................................................................................13
1.1.20 dot1x guest-vlan................................................................................................................................................................................... 14
1.1.21 dot1x guest-vlan id...............................................................................................................................................................................14
1.1.22 dot1x forbid multi-network-adapter..................................................................................................................................................15
1.1.23 dot1x keepalive ..................................................................................................................................................................................... 16
1.1.24 dot1x vendor-permit............................................................................................................................................................................ 16
1.1.25 dot1x vendor......................................................................................................................................................................................... 17
1.1.26 aaa authentication dot1x .....................................................................................................................................................................17
1.1.27 debug dot1x errors............................................................................................................................................................................... 18
1.1.28 debug dot1x state .................................................................................................................................................................................18
1.1.29 debug dot1x packet ............................................................................................................................................................................. 19
1.1.30 show dot1x ............................................................................................................................................................................................ 20

www.fs.com
OLT3610 Series 802.1x CONFIGURATION COMMANDS

Chapter 1 802.1x Configuration Commands

1.1 802.1x Configuration Commands

802.1x configuration commands include:

 dot1x enable

 dot1x port-control

 dot1x authentication multiple-hosts

 dot1x authentication multiple-auth

 dot1x default

 dot1x reauth-max

 dot1x re-authentication

 dot1x timeout quiet-period

 dot1x timeout re-authperiod

 dot1x timeout tx-period

 dot1x timeout misc-mab-refresh

 dot1x timeout misc-mab-aging

 dot1x mab

 dot1x mabformat

 dot1x user-permit

 dot1x authentication method

 dot1x accounting enable

 dot1x accounting method

 dot1x authen-type, dot1x authentication type

 dot1x guest-vlan

 dot1x guest-vlan id

 dot1x forbid multi-network-adapter

www.fs.com 1
OLT3610 Series 802.1x CONFIGURATION COMMANDS

 dot1x keepalive

 Dot1x vendor-permit

 Dot1x vendor

 aaa authentication dot1x

 debug dot1x error

 debug dot1x state

 debug dot1x packet

 show dot1x

1.1.1 dot1x enable

Syntax

dot1x enable

no dot1x enable

Parameter None

Default None

Command Mode Global Configuration Mode

Usage Guidelines Use this command to enable 802.1x feature. The 802.1x feature cannot be enabled on an interface. If 802.1x feature is
disabled, then all 802.1x packets will be forwarded like other multi-cast packets in VLAN rather than be received by CPU.

Example The following example shows how to enable dot1x:

Switch_config#dot1x enable

1.1.2 dot1x port-control

Syntax

dot1x port-control {auto | force-authorized | force-unauthorized | misc-mab}

www.fs.com 2
OLT3610 Series 802.1x CONFIGURATION COMMANDS

no dot1x port-control

Parameter

Parameter Description

auto Enables 802.1x protocol authentication method

force-authorized Forced port authentication passed.
force-unauthorized Forced port authentication failed.
Misc-mab Hybrid mode for multi-user and mab authentication.

Default force-authorized

Command Mode Interface configuration mode

Usage Guidelines The 802.1x protocol is an interface-based two-layer authentication mode. You can run the auto command to enable
the authentication mode. This authentication mode can be configured only on the physical interface and the interface’s attributes cannot
include VLAN backbone, dynamical access, security port or listening port.This command is not supported on the PON port.

Example The following example enables 802.1x on interface tg0/1:

Switch_config_tg0/1# dot1x port-control auto

The following example configures tg0/1 as the vlan trunk port and enables

802.1x:

Switch_config_tg0/1# switchport mode trunk

Switch_config_tg0/1# dot1x port-control auto

802.1x Control Failed, can't config 802.1x on vlanTrunk port(TGigaEthernet0/1)

1.1.3 dot1x authentication multiple-hosts

Syntax

dot1x authentication multiple-hosts

no dot1x authentication multiple-hosts

Parameter None

www.fs.com 3
OLT3610 Series 802.1x CONFIGURATION COMMANDS

Default Disable the multiple authentication of 802.1x.

Usage Guidelines Set one port to the multi-hosts mode of 802.1x, and the OLT will authenticate different users. When one user passes
the authentication, the port sets to the “up” state. Other users can access the port without authentication.

NOTE: After modifying the multi-host authentication mode, all users of the port will be authenticated again. This command is not

supported on the PON port.

Command Mode Interface configuration mode

Example The following example enables multiple-hosts authentication on interface tg0/1:

Switch_config_tg0/1# dot1x authentication multiple-hosts

1.1.4 dot1x authentication multiple-auth

Syntax

dot1x authentication multiple-auth

no dot1x authentication multiple-auth

Parameter None

Default Disable the multiple authentication of 802.1x.

Usage Guidelines After set one interface to the multiple-auth mode of 802.1x, the OLT will set authentication for each user. The
authentication for each user is unrelated. The interface shows “up” only when one user is successfully authenticate; the interface shows
“down” when all users fail to authenticate. Thus, each user is respectively authenticated and any user’s failure of authentication has no
effect on the authority of other users.

NOTE: The multi-auth mode cannot be configured with guest vlan, nor with mab. To modify the multi-host mode, all user need to be

re-authenticated. This command is not supported on the PON port.

Command Mode Interface configuration mode

Example The following example shows how to enable multiple-auth in interface tg0/1:

Switch_config _tg0/1# dot1x authentication multiple-auth

Switch_config _tg0/1#

www.fs.com 4
OLT3610 Series 802.1x CONFIGURATION COMMANDS

1.1.5 dot1x default

Syntax

dot1x default

Parameter None

Default None

Command Mode Global Configuration Mode

Usage Guidelines The command is used to return all configurations to the default setting.

Example The command shows how to return all configurations of dot1x to the default setting.

Switch_config # dot1x default

1.1.6 dot1x reauth-max

Syntax

dot1x reauth-max count

no dot1x reauth-max

Parameter

Parameter Syntax

count Maximum number of retries. The value is from 1 to 10.

Default 5

Usage Guidelines Use this command to set maximum number of re-authentications. The authentication will be suspended when there is
no response from client on exceeding the number of this configured re-authentication times.

Command Mode Global configuration mode

www.fs.com 5
OLT3610 Series 802.1x CONFIGURATION COMMANDS

Example The following example set 4 as the maximum number of re-authentications:

Switch_config # dot1x reauth-max 4

1.1.7 dot1x re-authentication

Syntax
dot1x re-authentication
no dot1x re-authentication

Parameter None

Default None

Usage Guidelines You configure the amount of time between the periodic re-authentication attempts by using the dot1x timeout
re-authperiod global configuration command.

Command Mode Global configuration mode

Example This example shows how to enable the periodic re-authentication:

Switch_config # dot1x re-authentication

1.1.8 dot1x timeout quiet-period

Syntax

dot1x timeout quiet-period time

no dot1x timeout quiet-period

Parameter

Parameter Syntax

time Period of re-enabling authentication, in the range from 0 to 65535 seconds

Default 60s

Usage Guidelines There will be a period of quiet time after authentication failure during which OLT doesn’t receive or enable any
authentication.

www.fs.com 6
OLT3610 Series 802.1x CONFIGURATION COMMANDS

Command Mode Global configuration mode

Example The following example configures quiet period value to 40:

Switch_config # dot1x timeout quiet-period 40

1.1.9 dot1x timeout re-authperiod

Syntax

dot1x timeout re-authperiod time

no dot1x timeout re-authperiod

Parameter

Parameter Description

time Period of re-authentication, in the range from 1 to 4294967295

seconds

Default 3600s

Usage Guidelines This command is valid only after enabling the dot1x re-authentication command.

Command Mode Global configuration mode

Example The following example configures dot1x re-authentication period to 7200s:

Switch_config # dot1x timeout re-authperiod 7200

1.1.10 dot1x timeout tx-period

Syntax

dot1x timeout tx-period time

no dot1x timeout tx-period

Parameter

Parameter Description

time Time is from 1 to 65535s.

www.fs.com 7
OLT3610 Series 802.1x CONFIGURATION COMMANDS

Default 30s

Usage Guidelines This command specifies the time interval of the host client to respond to the authentication request. The OLT will
resend the authentication request when exceeding this time interval.

Command Mode Global Configuration Mode

Example The following command sets 24 as the timeout period:

Switch_config # dot1x timeout tx-period 24

1.1.11 dot1x timeout misc-mab-refresh

Syntax

dot1x timeout misc-mab-refresh time

no dot1x timeout misc-mab-refresh

Parameter

Parameter Description

time Time, 10- 65535s

Default 10s

Command Mode Global Configuration Mode

Usage Guidelines This command can configure the refresh interval of the misc-mab mode, after which the OLT will refresh the mac
address table.

Example The following command will configure the refresh time of misc-mab mode to 100s:

Switch_config # dot1x timeout misc-mab-refresh 100

1.1.12 dot1x timeout misc-mab-aging

Syntax

www.fs.com 8
OLT3610 Series 802.1x CONFIGURATION COMMANDS

dot1x timeout misc-mab-aging time

no dot1x timeout misc-mab-aging

Parameter

Parameter Description

time time, 20 - 65535s

Default 20s

Command Mode Global Configuration Mode

Usage Guidelines This command can configure the time interval for the aging of the mac address in misc-mab mode, and the mac
address will age after this time.

Example The following command will configure the misc-mab mode mac address aging time to 300:

Switch_config # dot1x timeout misc-mab-aging 300

1.1.13 dot1x mab

Syntax

dot1x mab
no dot1x mab

Parameter None

Default Disabled

Usage Guidelines When a peer device cannot run the 802.1x client software, the OLT will adopt the MAB (MAC Authentication Bypass)
authentication mode and then the MAC address of the peer device will be sent as both the username and password to the radius server
for authentication.

When MAB is enabled and the peer device, however, neither sends the eapol_start packet nor responds to the request_identity packet

and exceeds the timeout threshold, the OLT regards the peer device not to support the 802.1x authentication client and then turns to the

MAB authentication. The OLT sends the obtained mac address of the device as the user name and password to the radius server for

authentication. If the mac address has been authorized on the radius server, the authentication is successful and the user is allowed to

access the network through the port.

NOTE: The multi-auth mode cannot coexist with guest vlan or mab. This command is not supported on the PON port.

www.fs.com 9
OLT3610 Series 802.1x CONFIGURATION COMMANDS

Command Mode Interface Configuration Mode

Example The following example shows how to enable mab authentication in interface tg0/1.

Switch_config_tg0/1# dot1x mab

1.1.14 dot1x mabformat

Syntax

dot1x mabformat {1|2|3|4|5|6}

no dot1x mabformat

Parameter

Parameter Description

1 MAC address format: aa:bb:cc:dd:ee:ff

2 MAC address format: AA:BB:CC:DD:EE:FF

3 MAC address format: aabbccddeeff

4 MAC address format: AABBCCDDEEFF

5 MAC address format: aa-bb-cc-dd-ee-ff

6 MAC address format: AA-BB-CC-DD-EE-FF

Default The default is 1.

Usage Guidelines When the MAB authentication is enabled, you can set the format of the MAC address to the Radius server through this
command.

Command Mode Global configuration mode

Example The following example shows how to configure the mac format as 3.

Switch_config # dot1x mabformat 3

1.1.15 dot1x user-permit

Syntax

dot1x user-permit xxx yyy zzz

no dot1x user-permit

www.fs.com 10
OLT3610 Series 802.1x CONFIGURATION COMMANDS

Parameter

Parameter Syntax

xxx Username

yyy Username

zzz Username

Default All users are allowed to pass without user-bind.

Usage Guidelines Use this command to bind user on the interface, eight users can be binded on each interface. When 802.1x
authentication enabled, the authentication is only available to the binding user. This command is not supported on the PON port.

Command Mode Interface configuration mode

Example The following example configures a,b,c,d as the binding user on interface tg0/1:

Switch_config _tg0/1# dot1x user-permit a b c d

1.1.16 dot1x authentication method

Syntax

dot1x authentication method xxx

no dot1x authentication method

Parameter

Parameter Description

xxx Method name.

Default “default” method

Usage Guidelines This command is used to configure the authentication method which must be one of authentication methods
provided by AAA. One interface only uses one authentication method. When AAA performs authentication to the 802.1x user, AAA would
select the configured authentication method to perform the authentication. This command is not supported on the PON port.

Command Mode Interface configuration mode

www.fs.com 11
OLT3610 Series 802.1x CONFIGURATION COMMANDS

Example The following example shows that how to set the authentication method of tg0/1 to abcd. The method applies the local user
name to authenticate. In interface tg1/2 set the authentication method to efgh. The method applies radius remote authentication.

Switch_config # aaa authentication dot1x abcd local

Switch_config # aaa authentication dot1x efgh group radius
Switch_config _tg0/1# dot1x authentication method abcd
Switch_config _tg0/1# interface tg1/2

Switch_config _tg1/2# dot1x authentication method efgh

1.1.17 dot1x accounting enable

Syntax

dot1x accounting enable

no dot1x accounting enable

Parameter None

Default Disabled

Usage Guidelines Use this command to enable accounting feature on the interface. This command must combine with the

authentication feature. You’d better enable dotx re-authentication feature. This command is not supported on the PON port.

Command Mode Interface Configuration Mode

Example The following command enables the dot1x authentication and accounting feature of interface tg0/1:
Switch_config # dot1x enable
Switch_config # interface tg0/1
Switch_config _tg0/1# dot1x port auto
Switch_config _tg0/1# dot1x accounting enable

1.1.18 dot1x accounting method

Syntax

dot1x accounting method xxx

no dot1x accounting method

Parameter

Parameter Syntax

www.fs.com 12
OLT3610 Series 802.1x CONFIGURATION COMMANDS

xxx Accounting method name

Default “default” method.

Usage Guidelines Use this command to configure the accounting method on an interface. This method is one of the accounting
methods that AAA provides. Each interface only uses one method. When enabled dot1 accounting feature, this method will be used to
perform accounting. This command is not supported on the PON port.

Command Mode Interface configuration mode

Example The following example configures abcd as the accounting method on interface tg0/1 and this method uses radius server:

Switch_config # aaa accounting network abcd start-stop group radius

Switch_config # radius-server host 192.168.20.100
Switch_config # interface tg0/1

Switch_config _tg0/1# dot1x accounting method abcd

1.1.19 dot1x authen-type, dot1x authentication type

Syntax

dot1x authen-type {chap|eap}

no dot1x authen-type

To set the authentication type in global configuration mode, run the above command. To return to the default setting, use the no form of

this command.

dot1x authentication type {chap|eap}

no dot1x authentication type

To set the authentication type in interface configuration mode, run the above command. To return to the default setting, use the no form

of this command.

Parameter None

Default Eap in global configuration mode. Default authentication type of the interface is same as in the global configuration mode.

Usage Guidelines The authentication type decides whether AAA uses the CHAP authentication or the EAP authentication. If the CHAP
authentication is used, the challenge required by MD5 is locally generated; if the EAP authentication is used, the challenge is generated on
the authentication server. Only one authentication mode can be applied to one interface. By default, the authentication mode is applied
in global mode. When an authentication mode is configured for an interface, the authentication mode will be always used on the interface

www.fs.com 13
OLT3610 Series 802.1x CONFIGURATION COMMANDS

unless the negative form of the command is run to resume the default settings.

Command Mode Interface and global configuration mode

Example The following example shows how to set the authentication type on interface tg0/1 to chap and the global authentication type
to eap.

Switch_config # dot1x authen-type eap

Switch_config # interface tg0/1
Switch_config _tg0/1# dot1x authentication type chap

1.1.20 dot1x guest-vlan

Syntax

Enable the guest-vlan feature of the dot1x with dot1x guest-vlan command in global configuration mode, and disable with the no form of

this command.

dot1x guest-vlan

no dot1x guest-vlan

Parameter None

Default Disable

Usage Guidelines When you enable the guest-vlan command, the software will assign the corresponding port to a guest VLAN when it
does not receive a response from the client. This command is used with the dot 1x guest-valan id interface configuration command.

NOTE: This command cannot be configured with multiple-auth command simultaneously.

Command Mode Global configuration mode

Example The following example enables guest-vlan feature in global configuration mode:

Switch_config # dot1x guest-vlan

1.1.21 dot1x guest-vlan id

Syntax

To configure dot1x guest-vlan id value (range from 1 to 4094) on an interface, use the dot1x guest-vlan command. Use the no form of this

command to restore the default value (0).

www.fs.com 14
OLT3610 Series 802.1x CONFIGURATION COMMANDS

dot1x guest-vlan id

no dot1x guest-vlan

Parameter Id: guest vlan value, which can be any configured vlan id in the system.

Default None

Usage Guidelines When you enable the guest-vlan command, the software will assign the corresponding port to a guest VLAN when it
does not receive a response from the client. This command is used with the dot1x guest-vlan global configuration command.

NOTE: This command cannot be configured with multiple-auth command simultaneously. This command is not supported on the PON
port.

Command Mode Interface configuration mode

Example The following example configures guest-vlan id value on the interface tg0/1:

Switch_config _tg0/1# dot1x guest-vlan 2

1.1.22 dot1x forbid multi-network-adapter

Syntax
To forbid the supplicant of the multi-network-adapter, use the dot1x forbid multi-network-adapter command. Use no form of this
command to restore the default configuration.

dot1x forbid multi-network-adapter

no dot1x forbid multi-network-adapter

Parameter None

Default None

Usage Guidelines Use this command to forbid the supplicant of the multi-network-adapter to avoid occurrence of the agent.

This command is not supported on the PON port.

www.fs.com 15
OLT3610 Series 802.1x CONFIGURATION COMMANDS

Command Mode Interface configuration mode

Example The following example forbids the supplicant of the multi-network-adapter on the interface tg0/1:

Switch_config _tg0/1 # dot1x forbid multi-network-adapter

1.1.23 dot1x keepalive

Syntax

dot1x keepalive

no dot1x keepalive

To enable/disable the keepalive detection for the authentication user in the global configuration mode, run the above commands.

Parameter None

Default Enable

Usage Guidelines The default is to enable the keepalive detection.

Command Mode Global configuration mode

Example The following example shows how to disable the keepalive function.

Switch_config # no dot1x keepalive

1.1.24 dot1x vendor-permit

Syntax

dot1x vendor-permit
no dot1x vendor-permit

Parameter None

Default Disable

www.fs.com 16
OLT3610 Series 802.1x CONFIGURATION COMMANDS

Command Mode Global Configuration Mode

Usage Guidelines This command enables the vendor forwarding function. After enabled, the OLT is allowed to forward vendor
information to the radius authentication server during the authentication process. This function is disabled by default. This command is
used with the command dot1x vendor.

Example The following command will enable vendor forwarding in global mode:

Switch_config # dot1x vendor-permit

1.1.25 dot1x vendor

Syntax

dot1x vendor word

no dot1x vendor

Parameter

Parameter Description

word Vendor information

Default None

Command Mode Global Configuration Mode

Usage Guidelines Configure vendor information.

Example The following command will configure the vendor name as LENOVO in global mode:

Switch_config # dot1x vendor LENOVO

1.1.26 aaa authentication dot1x

Syntax

aaa authentication dot1x {default | word } method1 [ method2...] [continue-on-failed]

no aaa authentication dot1x { default | word}

www.fs.com 17
OLT3610 Series 802.1x CONFIGURATION COMMANDS

Parameter

Parameter Syntax

Default authentication method. Use this authentication method when you do not
default
specify the authentication method using the dot1x authentication method command.

word Designate the name of the authentication method

method1 [method2...] group radius/tacacs+/xxx, local, local-case, none

continue-on-failed After the authentication fails, continue to try the next authentication method.

Default None

Usage Guidelines The method parameter identifies the list of methods that the authentication algorithm tries in the given sequence to
validate the password provided by the client. It is best to use radius authentication for the 802.1X aaa authentication, or you can use local
configuration data for authentication, such as the user password stored locally in the configuration.Use the continue-on-failed to enable
the function of continuing to try the next authentication method after authentication fails; in the traditional AAA method list,
authentication will end after authentication fails, and only enter to the next authentication when the method is unavailable (the server is
unreachable); if you add continue-on-failed at the end of the configuration method list, it means that after each authentication fails (For
example, the user name or password is wrong.), the next authentication continues until it succeeds

Command Mode Global configuration mode

Example The following example configures RADIUS as the dot1x authentication method:

Switch_config # aaa authentication dot1x default group radius

1.1.27 debug dot1x errors

Syntax
debug dot1x errors

Parameter None

Default None

Usage Guidelines This command is used to debug all error information during dot1x running to locate errors.

1.1.28 debug dot1x state

www.fs.com 18
OLT3610 Series 802.1x CONFIGURATION COMMANDS

Syntax

debug dot1x state

Parameter None

Default None

Command Mode Privileged configuration mode

Usage Guidelines Output format is as follows:

2017-3-18 17:40:09 802.1x:AuthSM(tg0/1) state Connecting-> Authenticating, event rxRespId

2017-3-18 17:40:09 802.1x:tg0/1 Create user for Enter authentication
2017-3-18 17:40:09 802.1x:BauthSM(tg0/1) state Idle-> Response, event authStart
2017-3-18 17:40:09 802.1x:tg0/1 user "myname" denied, Authentication Force Failed
2017-3-18 17:40:09 802.1x:tg0/1 Authentication Fail
2017-3-18 17:40:09 802.1x:BauthSM(tg0/1) state Response-> Fail, event aFail

1.1.29 debug dot1x packet

Syntax

debug dot1x packet

Parameter None

Default None

Command Mode Privileged configuration mode

Usage Guidelines Switch# debug dot1x packet

2017-3-18 17:40:09 802.1xg0/1 Tx --> Supplicant(0008.74bb.d21f)

EAPOL ver:01, type:00, len:5
EAP code:01, id:03, type:01, len:5
00
2017-3-18 17:40:09 802.1x:g0/1 Rx <-- Supplicant(0008.74bb.d21f)
EAPOL ver:01, type:00, len:10
EAP code:02, id:03, type:01, len:10

62 64 63 6f 6d a5

www.fs.com 19
OLT3610 Series 802.1x CONFIGURATION COMMANDS

1.1.30 show dot1x

Syntax

To show 802.1x configuration information, use the show dot1x command.

show dot1x [interface intf-id | statistics|misc-mab-db]

Parameter

Parameter Description
interface
Shows the dot1x interface information
intf-id
The concrete physical interface.
statistics
Shows the dot1x statistics information
misc-mab-db Shows the dot1x mixing Mab statistics information

Default None

Usage Guidelines This command is used to show 802.1x configuration information.

Command Mode EXEC or configuration mode

Example The following example shows how to display 802.1x configuration information:

Switch_config# show dot1x

802.1X Parameters
reAuthen No
reAuth-Period 3600
quiet-Period 60
Tx-Period 30
Supp-timeout 30
Server-timeout 30
reAuth-max 5
max-request 3
authen-type Eap

www.fs.com 20