802.1X+MAC認證接入後5s內進入guest vlan

交換機上配置了802.1X+MAC認證+guest vlan：

#

 dot1x

 dot1x authentication-method eap

 dot1x quiet-period

 dot1x timer quiet-period 10

 dot1x timer tx-period 5

#

 mac-authentication 

 mac-authentication timer quiet 1 

 mac-authentication user-name-format mac-address with-hyphen uppercase 

#

interface GigabitEthernet1/0/2

 dot1x

 undo dot1x handshake

 dot1x mandatory-domain imc_dot1x

 undo dot1x multicast-trigger

 dot1x unicast-trigger

 dot1x timer reauth-period 60

 mac-authentication

 mac-authentication carry user-ip

 mac-authentication domain imc_dot1x

 mac-authentication timer auth-delay 10

 mac-authentication guest-vlan 450

 undo mac-authentication offline-detect enable

#

測試認證終端接入認證到進入guest vlan需要花30s以上，想要實現接入後進入guest vlan的時間在5s內。

收集debugging dot1x all、debugging mac-authentication all、debugging radius all

從debug看整個流程都是正常的：

*Jul  3 02:08:19:982 2024 S5130 DOT1X/7/EVENT: Processing new mac event: UserMAC=****.****.****.****, VLANID=450, Interface=GigabitEthernet1/0/2.

====1x處理newmac;

*Jul  3 02:08:31:993 2024 S5130 MACA/7/EVENT: Processing MAC authentication delay: UserMAC=****.****.****.****, VLANID=450, Interface=GigabitEthernet1/0/2.

====1x 客戶端2次沒有應答，總共10秒左右超時，轉mac-auth；macauth添加延遲表；

*Jul  3 02:08:42:402 2024 S5130 MACA/7/EVENT: Authentication delay timer expired: UserMAC=****.****.****.****, VLANID=450, Interface=GigabitEthernet1/0/2.

====在10秒後，開始觸發macauth；

*Jul  3 02:08:42:403 2024 S5130 MACA/7/EVENT: Notified PortSec of new MAC processing result 3: UserMAC=****.****.****.****, VLANID=450, Interface=GigabitEthernet1/0/2.

====但認證直接結束，看配置有mac-authentication carry user-ip， 分析是由於驅動上報newmac的ip為0被攔住了

*Jul  3 02:08:44:628 2024 S5130 DOT1X/7/EVENT: Processing new mac event: UserMAC=****.****.****.****, VLANID=450, Interface=GigabitEthernet1/0/2.

====然後還是上麵這個邏輯，1x收到newmac在重新處理，再轉macauth, 等macauth延遲認證超時，再觸發macauth，但這回真正觸發了macauth，即new mac報的ip非0，然後認證失敗加gvlan.

發現按照目前的配置是需要等待802.1X超時，進入MAC認證，MAC認證失敗後才進入到guest vlan中。

查詢配置發現可以配置802.1X的guest vlan，實現觸發802.1X認證就進入guest vlan。

更改後實測在接入後的兩秒內可以進入guest vlan：

%Jul  4 06:22:41:807 2024 S5130 IFNET/5/LINK_UPDOWN: Line protocol state on the interface GigabitEthernet1/0/2 changed to up.

*Jul  4 06:22:42:746 2024 S5130 DOT1X/7/EVENT: Processing new mac event: UserMAC=****.****.****.****, VLANID=450, Interface=GigabitEthernet1/0/2.

*Jul  4 06:22:42:811 2024 S5130 DOT1X/7/EVENT: Started the user aging timer in the guest VLAN: Length=1000(s), UserMAC=****.****.****.****, VLANID=450, Interface=GigabitEthernet1/0/2.

更改配置為：

#

interface GigabitEthernet1/0/2

 dot1x

 undo dot1x handshake

 dot1x mandatory-domain imc_dot1x

 undo dot1x multicast-trigger

 dot1x unicast-trigger

 dot1x guest-vlan 450

 dot1x timer reauth-period 60

 mac-authentication

 mac-authentication domain imc_dot1x

 mac-authentication timer auth-delay 10

 mac-authentication guest-vlan 450

 mac-authentication guest-vlan auth-period 5

 undo mac-authentication offline-detect enable

#