Catalyst 3750-E and 3560-E Switch Cisco IOS ... - DNIP . NET

Chapter 2Catalyst 3750-E and 3560-E Switch Cisco IOS Commandsdot1x critical (interface configuration)dot1x critical (interface configuration)Use the dot1x critical interface configuration command on the switch stack or on a standalone switchto enable the inaccessible-authentication-bypass feature, also referred to as critical authentication or theauthentication, authorization, and accounting (AAA) fail policy. You can also configure the accessVLAN to which the switch assigns the critical port when the port is in the critical-authentication state.To disable the feature or return to default, use the no form of this command.dot1x critical [recovery action reinitialize | vlan vlan-id]no dot1x critical [recovery | vlan]Syntax Descriptionrecovery action reinitializevlan vlan-idEnable the inaccessible-authentication-bypass recovery feature, andspecify that the recovery action is to authenticate the port when anauthentication server is available.Specify the access VLAN to which the switch can assign a criticalport. The range is from 1 to 4094.DefaultsThe inaccessible-authentication-bypass feature is disabled.The recovery action is not configured.The access VLAN is not configured.Command ModesInterface configurationCommand HistoryRelease12.2(35)SE2ModificationThis command was introduced.Usage GuidelinesTo specify the access VLAN to which the switch assigns a critical port when the port is in thecritical-authentication state, use the vlan vlan-id keywords. The specified type of VLAN must match thetype of port, as follows:• If the critical port is an access port, the VLAN must be an access VLAN.• If the critical port is a private VLAN host port, the VLAN must be a secondary private VLAN.• If the critical port is a routed port, you can specify a VLAN, but this is optional.If the client is running Windows XP and the critical port to which the client is connected is in thecritical-authentication state, Windows XP might report that the interface is not authenticated.If the Windows XP client is configured for DHCP and has an IP address from the DHCP server, receivingan EAP-Success message on a critical port might not re-initiate the DHCP configuration process.OL-9776-08Catalyst 3750-E and 3560-E Switch Command Reference2-157