Configuring an 802.1X Access Profile

Procedure

1. Run system-view

   The system view is displayed.

2. Run dot1x-access-profile name access-profile-name

   The 802.1X access profile view is displayed.

3. Run dot1x authentication-method { chap | pap | eap }

   An authentication mode is configured for 802.1X users.

   By default, the authentication mode of 802.1X users is eap, which indicates Extensible Authentication Protocol (EAP) relay authentication.

   The processing capability of the RADIUS server determines whether EAP termination or EAP relay is used. If the RADIUS server has a higher processing capability and can parse a large number of EAP packets before authentication, the EAP relay mode is recommended. If the RADIUS server has a processing capability not good enough to parse a large number of EAP packets and complete authentication, the EAP termination mode is recommended and the device parses EAP packets for the RADIUS server. When the authentication packet processing method is configured, ensure that the client and server both support this method; otherwise, the users cannot pass authentication.

   

   • The EAP relay can be configured for 802.1X users only when RADIUS authentication is used.

   • If AAA local authentication is used, the authentication mode for 802.1X users can only be set to EAP termination.

   • Because mobile phones do not support EAP termination mode (PAP and CHAP), the 802.1X authentication + local authentication mode cannot be configured for mobile phones. Terminals such as laptop computers support EAP termination mode only after having third-party clients installed.

   • If the 802.1X client uses the MD5 encryption mode, the user authentication mode on the device can be set to EAP or CHAP; if the 802.1X client uses the PEAP authentication mode, the authentication mode on the device can be set to EAP.

   • In a wireless access scenario, if WPA or WPA2 authentication mode is configured in the security policy profile, 802.1X authentication does not support pre-authentication domain-based authorization.
   • If an interface has online 802.1X users and the authentication mode is changed between EAP termination and EAP relay in the 802.1X access profile bound to the interface, the online 802.1X users will be logged out. If the authentication mode is changed between CHAP and PAP in EAP termination mode, the online 802.1X users will not be logged out.
   

   CHAP and PAP authentication use the insecure MD5 algorithm, so EAP authentication is recommended.