Periodic Reauthentication of Authenticated Clients
Note: Reauthentication is enabled by default for restricted VLANs and critical VLANs. Reauthentication
is not supported for guest VLANs.
ICX devices can be configured to periodically
reauthenticate authenticated clients that are connected to interfaces enabled for
IEEE
802.1X authentication and MAC authentication. When periodic reauthentication is
enabled
using the re-authentication command, the ICX device reauthenticates clients every
3,600 seconds (1 hour) by default. The reauthentication interval is configurable
using
the reauth-period
command. The RADIUS server can overwrite this interval for each client using the
Session-Timeout and Termination-Action attributes.
Note: Shorter reauthentication periods require more CPU cycles. A reauthentication
period greater than 300 seconds is recommended.
Note: With the dead RADIUS server enhancement, RADIUS
servers are monitored and marked dead when they do not respond. When no RADIUS
servers are available, a client reauthentication attempt results in a timeout.
Therefore, when no servers are available, reauthentication is not performed.
Instead, the timeout action is performed, and the client continues with the same
credentials when the
auth-timeout-action command configuration is set to success or
critical-vlan. This avoids potential issues with some IEEE 802.1X clients that
are
known to go into an inconsistent state after client reauthentication times out
and
when the auth-timeout-action command configuration is set to success.