Managing 802.1X on the WSS Switch 491
Nortel WLAN Security Switch 2300 Series Configuration Guide
Setting 802.1X Port Control
The following command specifies the way a wired authentication port or group of ports handles user 802.1X
authentication attempts:
set dot1x port-control {forceauth | forceunauth | auto} port-list
The default setting is auto, which allows the WSS switch to process 802.1X authentication normally
according to the authentication configuration. Alternatively, you can set a wired authentication port or ports to
either unconditionally authenticate or unconditionally reject all users.
For example, the following command forces port 19 to unconditionally authenticate all 802.1X authentication
attempts with an EAP success message:
23x0# set dot1x port-control forceauth 19
success: authcontrol for 19 is set to FORCE-AUTH.
Similarly, the following command forces port 12 to unconditionally reject any 802.1X attempts with an EAP
failure message:
23x0# set dot1x port-control forceunauth 12
success: authcontrol for 12 is set to FORCE-UNAUTH.
The set dot1x port-control command is overridden by the set dot1x authcontrol command. The clear dot1x
port-control command returns port control to the default auto value.
Type the following command to reset port control for all wired authentication ports:
23x0# clear dot1x port-control
success: change accepted.
Managing 802.1X Encryption Keys
By default, the WSS switch sends encryption key information to a wireless supplicant (client) in an Extensible
Authentication Protocol over LAN (EAPoL) packet after authentication is successful. You can disable this
feature or change the time interval for key transmission.
The secret Wired-Equivalent Privacy protocol (WEP) keys used by WSS Software on AP access ports for
broadcast communication on a VLAN are automatically rotated (rekeyed) every 30 minutes to maintain secure
packet transmission. You can disable WEP key rotation for debugging purposes, or change the rotation
interval.
