Cisco WS-C3560E-48PD-SF Command Reference - Page 120

dot1x critical Chapter 2 Catalyst 3560 Switch Cisco IOS Commands dot1x critical Use the dot1x critical interface configuration command to enable the inaccessible authentication bypass feature. To disable the feature, use the no form of this command. dot1x critical no dot1x critical Syntax Description This command has no arguments or keywords. Defaults The inaccessible authentication bypass feature is disabled. Command Modes Interface configuration Command History Release 12.2(25)SED Modification This command was introduced. Usage Guidelines This feature is supported only on IEEE 802.1x ports in single-host mode. If you try to configure the port as a critical port or if you change the host mode to multiple-hosts mode, this message appears: %Command rejected: Critical ports are only allowed in single-host mode If the client is running Windows XP and the critical port to which the client is connected is in the critical-authentication state, Windows XP might report that the interface is not authenticated. If the Windows XP client is configured for DHCP and has an IP address from the DHCP server, receiving an EAP-Success message on a critical port might not re-initiate the DHCP configuration process. You can configure the inaccessible authentication bypass feature and the restricted VLAN on an IEEE 802.1x port. If the switch tries to re-authenticate a critical port in a restricted VLAN and all the RADIUS servers are unavailable, the switch changes the port state to the critical authentication state, and it remains in the restricted VLAN. You can configure the inaccessible bypass feature and port security on the same switch port. 2-88 Catalyst 3560 Switch Command Reference 78-16405-05