Junos® OS Ethernet Interfaces Configuration ... - Juniper Networks

Junos ®
OS 12.3 Ethernet Interfaces Configuration Guide
Related
Documentation
Dynamic changes to a user session are supported to allow the router administrator to
terminate an already authenticated session by using the “RADIUS disconnect” message
defined in RFC 3576.
•
Understanding the Administrative State of the Authenticator Port on page 288
• Understanding the Administrative Mode of the Authenticator Port on page 288
• Configuring the Authenticator on page 289
• Viewing the dot1x Configuration on page 289
• Junos® OS Ethernet Interfaces
Understanding the Administrative State of the Authenticator Port
Related
Documentation
The administrative state of an authenticator port can take any of the following three
states:
• Force authorized—Allows network access to all users of the port without requiring
them to be authenticated. This is equivalent to not having any authentication enabled
on the port.
• Force unauthorized—Denies network access to all users of the port. This is equivalent
to disabling the port.
• Automatic—This is the default mode where the authentication server response
determines if the port is opened for traffic or not. Only the successfully authenticated
clients are allowed access, all others are denied.
In Junos OS, the default mode is “automatic.” The “force authorized” and “force
unauthorized” admin modes are not supported. You can achieve the functionality of
“force authorized” mode by disabling dot1x on the required port. You can achieve the
functionality of “force unauthorized” mode by disabling the port itself.
•
IEEE 802.1x Port-Based Network Access Control Overview on page 287
• Understanding the Administrative Mode of the Authenticator Port on page 288
• Configuring the Authenticator on page 289
• Viewing the dot1x Configuration on page 289
• Junos® OS Ethernet Interfaces
Understanding the Administrative Mode of the Authenticator Port
288
Junos OS supports the supplicant mode “single” and not the “single secure” nor “multiple”
modes. The “Single” mode option authenticates only the first client that connects to a
port. All other clients that connect later (802.1x compliant or noncompliant) are allowed
free access on that port without any further authentication. If the first authenticated
client logs out, all other users are locked out until a client authenticates again.
Copyright © 2012, Juniper Networks, Inc.