Enabling 802.1X guest VSI assignment delay

This feature delays assigning an 802.1X-enabled port to the 802.1X guest VSI when 802.1X authentication is triggered on the port.

This feature applies only to situations where 802.1X authentication is triggered by EAPOL-Start packets from 802.1X clients or packets from unknown MAC addresses.

To use this feature, the 802.1X-enabled port must perform MAC-based access control.

When 802.1X authentication is triggered on a port, the device performs the following operations:

1. Sends a unicast EAP-Request/Identity packet to the MAC address that triggers the authentication.

2. Retransmits the packet if no response is received within the username request timeout interval set by using the dot1x timer tx-period command.

3. Assigns the port to the 802.1X guest VSI after the maximum number of request attempts set by using the dot1x retry command is reached.

This feature can work with the parallel processing of MAC authentication and 802.1X authentication feature when a port performs a combination of 802.1X and MAC authentication. The collaboration facilitates the port to perform MAC authentication before it is assigned to the 802.1X guest VSI. For information about the parallel processing of MAC authentication and 802.1X authentication feature, see "Configuring MAC authentication."

1. Enter system view.

   system-view

2. Enter interface view.

   interface interface-type interface-number

3. Enable 802.1X guest VSI assignment delay on the port.

   dot1x guest-vsi-delay { eapol | new-mac }

   By default, 802.1X guest VSI assignment delay is disabled on a port.