dot1x port-control force-unauthorized

[HiTmAn47]

dot1x port-control force-unauthorized

My understanding of the above command is the following -

force-unauthorized—causes the port to remain in the unauthorized state, ignoring all attempts by the client to authenticate. The switch cannot provide authentication services to the client through the port

In what situation/s has anyone used the above command? Does this not essentially mean "nothing can use that port?"  isn't that basically means I shut the port !!

[HiTmAn47]

My understanding of the above command is the following -

force-unauthorized—causes the port to remain in the unauthorized state, ignoring all attempts by the client to authenticate. The switch cannot provide authentication services to the client through the port

In what situation/s has anyone used the above command? Does this not essentially mean "nothing can use that port?"  isn't that basically means I shut the port !!

[Francesco Molino · Accepted solution]

Hi

This means that this port is not shutdown but doesn't allow anyone to connect to it, your right.

Usually, you will use auto to put the port in unauthorized and as soon as someone is connected to and authenticated, it will switch to authorized.

Personally, i use this command when I'm staging your switch and don't want anyone to initiate any authentication process.

Let's take an example: you're deploying a new switch on a remote site and you don't want anybody to authenticate while you finish your config to not generate any logs and bring pushed into quarantine.

Is that clear?

[HiTmAn47]

Thanks alot , it makes sense now ....so this feature blocks anyone from connecting to the port without shutting it down .....But Still in your example I would have just shutdown every port instead of going through the hassle of applying this command on each port

[Francesco Molino]

Yes you're right you can shutdown as well but it's a way to work.
I shutdown ports that are unused and leave unauthorized ports that will be on production later during the staging.

I say to the customer to do a config on the interface and apply auto instead of no shutdown then I'm sure he won't unshut a port that needs to be shutted down

[Mohammed al Baqari]

In short this port won't be authorized and can't get DACL or VLAN vsa or
any other attribute from ISE. You can replace it with an ACL and restricted
ACEs or MAC security but I think you can use it if you want unified
environment where everything controlled from one place