交換機準入問題

現象：認證通過可以上網，不認證也可以上網，請問下什麼原因導致的

路由：到認證服務器路由可達

型號:H3C S5130S-28P-EI

部分配置：

radius scheme radius1

 primary authentication x.x.x.x

 primary accounting x.x.x.x

 key authentication cipher ***

 key accounting cipher ***

 user-name-format without-domain

 nas-ip x.x.x.x

#

radius scheme system

 user-name-format without-domain

#

domain bbb

 authentication lan-access radius-scheme radius1 none

 authorization lan-access radius-scheme radius1 none

 accounting lan-access radius-scheme radius1 none

#

domain system

#

domain default enable system

#

interface GigabitEthernet1/0/12

 port access vlan 20

 dot1x

 dot1x mandatory-domain bbb

 dot1x re-authenticate

 dot1x re-authenticate server-unreachable keep-online

 mac-authentication

 mac-authentication domain bbb

 mac-authentication parallel-with-dot1x

檢查命令

<S5130>dis dot1x connection 

Total connections: 1

Slot ID: 1

User MAC address: **5f-**00-**

Access interface: GigabitEthernet1/0/12

Username: ***

User access state: Successful 

Authentication domain: bbb

Authentication method: EAP

AAA authentication method: RADIUS

Initial VLAN: 20

Authorization untagged VLAN: N/A

Authorization tagged VLAN list: N/A

Authorization ACL number/name: N/A

Authorization dynamic ACL name: N/A

Authorization user profile: N/A

Authorization CAR: N/A

Authorization URL: N/A

Termination action: Radius-request

Session timeout period: 72000 s

Online from: 2013/01/01 01:03:51  

Online duration: 0h 0m 6s