Configuration

Hint: To avoid unexpected disconnection or shutdown of ports, it is advisable to disable dot1x authentication on trunk ports before enabling it. This applies to all ports, including those that are accessed remotely through protocols such as SSH, which could result in disconnection and inability to reconnect.

e.g. Trunkport on Gi1/0/24:

interface Gi1/0/24
dot1x port-control force-authorized

Global Settings for dot1x

aaa accounting dot1x default start-stop radius
authentication enable
dot1x system-auth-control
aaa authentication dot1x default radius
aaa authorization network default radius
dot1x dynamic-vlan enable
mab request format attribute 1 groupsize 12 separator . lowercase
radius server auth RADIUIS_IP_ADDRESS name "xeoxradius" key PRESHAREDKEY

dot1x dynamic-vlan enable is required for dynamic vlan assignment via XEOX. If you like to use static vlan assignment on switch/port level, remove this line.

Configuring the Ports

interface Gi1/0/1
dot1x port-control mac-based
dot1x reauthentication
dot1x unauth-vlan 50
mab
authentication order mab
authentication priority mab

dot1x unauth-vlan 50 means, in case of authentication reject the device, that would be assigned to VLAN 50 - e.g. Guest/Internet Only VLAN.

Full Example of a test Switch

testn3k#show run
!Current Configuration:
!Software Capability "Stack Limit = 8, VLAN Limit = 1024"
!Image File "N3000AdvLitev6.5.4.3"
!System Description "Dell EMC Networking N3024, 6.5.4.3, Linux 3.6.5-e3cd5a07, Not Available"
!System Software Version 6.5.4.3
!
configure
vlan 50,88
exit
vlan 50
name "unauth"
exit
hostname "testn3k"
slot 1/0 1    ! Dell EMC Networking N3024
sntp unicast client enable
sntp server "pool.ntp.org" priority 3
stack
member 1 1    ! N3024
exit
interface vlan 1
ip address 192.168.100.248 255.255.255.0
exit
ip default-gateway 192.168.100.254
aaa accounting dot1x default start-stop radius
authentication enable
dot1x system-auth-control
aaa authentication dot1x default radius
aaa authorization network default radius
dot1x dynamic-vlan enable
mab request format attribute 1 groupsize 12 separator . lowercase
radius server auth 192.168.123.124
name "xeoxradius"
key 7 "XXXXXX"
exit
ip ssh server
application install SupportAssist auto-restart start-on-boot
application install hiveagent start-on-boot
!
interface Gi1/0/1
spanning-tree portfast
switchport mode general
switchport general pvid 50
dot1x port-control mac-based
dot1x reauthentication
dot1x unauth-vlan 50
mab
authentication order mab
authentication priority mab
exit
!
interface Gi1/0/5
spanning-tree portfast
switchport mode general
switchport general pvid 50
dot1x port-control mac-based
dot1x reauthentication
dot1x unauth-vlan 50
mab
authentication order mab
authentication priority mab
exit
!
interface Gi1/0/24
switchport mode general
switchport general allowed vlan add 88 tagged
switchport general allowed vlan add 1 tagged
dot1x port-control force-authorized
exit
snmp-server engineid local 800xxxxb9796
exit

testn3k#

Dell Powerswitch Serie N

Configuration

Configuring the Ports

Full Example of a test Switch