802.1x clarification...

[jimmysands73_2]

For ports would this be correctly paraphrased?

Force-unauthorized - Port is effectively shutdown to all traffic.  Switch can not provide authentication to the client, effectively disabling this port.

Force-authorized - No authentication necessary, port would work when cable connected (granted other port config is correct).

Auto - Enables 802.1x, allows EAPOL frames to be sent/recv'd on this port.  If authentication succeeds, changes to authorized state and traffic passes.  If authentication fails, attempt to re-authenticate can be tried.

[Julio Carvajal · Accepted solution]

Hello Jimmy,

1- Force-unauthorized: Port cannot be used as it's unathorized. It will ignore all traffic ( even 802.1x traffic)

2-Force-authorized: 802.1x is not enabled on the interface, all traffic is allowed on the interface, Its the default state.

3-Auto: 802.1x is enabled on the interface, It will allow ( EAPOL,CDP and STP traffic ) before it authenticates succesfully, afterwards all traffic will be allowed.

Please rate all the helpful posts

Julio

Cisco Engineer

[allen00874]

Hi Guys,

Could someone please provide scenarios for the different use cases; it is obvious when to use the auto option. But when would you use Force-unauthorized or Force-authorized?

Thanks,

Allen

[Julio Carvajal]

Hello Allen:

Force-Unauthorized: Over a port that is not being used.

Force-Authorized: Over a port where the client does not support 802.1x and you want to grant permission to him.

Any other question..Sure.. Just remember to rate all of my answers.

Julio