topic Re: dot1x port-control force-unauthorized in Network Access Control

dot1x port-control force-unauthorized

HiTmAn47 — Fri, 21 Feb 2020 18:52:08 GMT

My understanding of the above command is the following -

force-unauthorized—causes the port to remain in the unauthorized state, ignoring all attempts by the client to authenticate. The switch cannot provide authentication services to the client through the port

In what situation/s has anyone used the above command? Does this not essentially mean "nothing can use that port?" isn't that basically means I shut the port !!

Re: dot1x port-control force-unauthorized

Francesco Molino — Wed, 28 Mar 2018 04:13:16 GMT

This means that this port is not shutdown but doesn't allow anyone to connect to it, your right.

Usually, you will use auto to put the port in unauthorized and as soon as someone is connected to and authenticated, it will switch to authorized.

Personally, i use this command when I'm staging your switch and don't want anyone to initiate any authentication process.

Let's take an example: you're deploying a new switch on a remote site and you don't want anybody to authenticate while you finish your config to not generate any logs and bring pushed into quarantine.

Is that clear?

Re: dot1x port-control force-unauthorized

Mohammed al Baqari — Wed, 28 Mar 2018 04:46:15 GMT

In short this port won't be authorized and can't get DACL or VLAN vsa or
any other attribute from ISE. You can replace it with an ACL and restricted
ACEs or MAC security but I think you can use it if you want unified
environment where everything controlled from one place

Re: dot1x port-control force-unauthorized

HiTmAn47 — Wed, 28 Mar 2018 10:16:37 GMT

Thanks alot , it makes sense now ....so this feature blocks anyone from connecting to the port without shutting it down .....But Still in your example I would have just shutdown every port instead of going through the hassle of applying this command on each port

Re: dot1x port-control force-unauthorized

Francesco Molino — Wed, 28 Mar 2018 13:59:18 GMT

Yes you're right you can shutdown as well but it's a way to work.
I shutdown ports that are unused and leave unauthorized ports that will be on production later during the staging.

I say to the customer to do a config on the interface and apply auto instead of no shutdown then I'm sure he won't unshut a port that needs to be shutted down