802.1X

nv set interface <interface-id> dot1x auth-fail-vlan

Enables or disables auth-fail VLAN on the specified interface. You can specify enabled or disabled. When you enable auth-fail VLAN, if a non-authorized supplicant tries to communicate with the switch, you can route traffic from that device to a different VLAN and associate that VLAN with one of the switch ports to which the supplicant attaches. Cumulus Linux assigns the auth-fail VLAN by manipulating the PVID of the interface.

Command Syntax

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set interface swp1 dot1x auth-fail-vlan enabled

nv set interface <interface-id> dot1x eap

Enables or disables 802.1X on the specified interfaces. You can specify enabled or disabled.

The IEEE 802.1X protocol provides a way to authenticate a client (called a supplicant) over wired media. It also provides access for individual MAC addresses on a switch (called the authenticator) after an authentication server authenticates the MAC addresses. The authentication server is typically a RADIUS server.

Command Syntax

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set interface swp1,swp2,swp3 dot1x eap enabled

nv set interface <interface-id> dot1x host-mode

Configures the 802.1X host mode. You can specify:

• Multi host authenticated mode (multi-host-authenticated), where RADIUS must authorize each supplicant to send traffic through the 802.1X interface. This is the default mode.
• Multi host mode ()multi-host), where the interface remains closed for all traffic until RADIUS authorizes the first supplicant. After authorization, any host can send and receive traffic through the 802.1X interface as long as the supplicant remains authorized.

Command Syntax

Version History

Introduced in Cumulus Linux 5.8.0

Example

cumulus@switch:~$ nv set interface swp1 dot1x host-mode multi-host

nv set interface <interface-id> dot1x ipv6-profile <profile-id>

Associates the IPv6 profile that defines the various parts of the IPv6 address prefix with an 802.1X interface for dynamic IPv6 multi-tenancy.

Dynamic IPv6 multi-tenancy using 802.1X authentication integrates RADIUS authentication, address assignment, access control, and routing to provide tenant-specific IPv6 connectivity. Use this feature to isolate tenant traffic in a multi-tenant environment in layer 3 IPv6 and advertise summary routes for the dynamically generated IPv6 addresses.

Command Syntax

Version History

Introduced in Cumulus Linux 5.15.0

Example

cumulus@switch:~$ nv set interface swp9,swp10 dot1x ipv6-profile TENANT-A

nv set interface <interface-id> dot1x mba

Enables or disables MBA for 802.1 X on the specified interface. You can specify enabled or disabled.

MBA enables bridged interfaces to allow devices to bypass authentication based on their MAC address. This is useful for devices that do not support EAP, such as printers or phones.

You must configure MBA on both the RADIUS server and the RADIUS client (the Cumulus Linux switch).

Command Syntax

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set interface swp1 dot1x mba enabled 

nv set interface <interface-id> dot1x tx-identity-request max-retries

Configures the maximum number of multicast EAPOL identity request retries. By default, the switch sends retries indefinitely at 30-second intervals until at least one supplicant responds to an EAPOL identity request with an EAP identity response. You can set a value between 0 and 65535.

Command Syntax

Version History

Introduced in Cumulus Linux 5.17.0

Example

cumulus@switch:~$ nv set interface swp1 dot1x tx-identity-request max-retries 50

nv set system dot1x auth-fail-vlan

Configures auth-fail VLAN. You can specify a value between 1 and 4094.

If a non-authorized supplicant tries to communicate with the switch, you can route traffic from that device to a different VLAN and associate that VLAN with one of the switch ports to which the supplicant attaches. Cumulus Linux assigns the auth-fail VLAN by manipulating the PVID of the interface.

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set system dot1x auth-fail-vlan 777 

nv set system dot1x dynamic-ipv6-multi-tenant state

Enables and disables dynamic IPv6 multi-tenancy.

Dynamic IPv6 multi-tenancy using 802.1X authentication integrates RADIUS authentication, address assignment, access control, and routing to provide tenant-specific IPv6 connectivity. Use this feature to isolate tenant traffic in a multi-tenant environment in layer 3 IPv6 and advertise summary routes for the dynamically generated IPv6 addresses.

Version History

Introduced in Cumulus Linux 5.15.0

Example

cumulus@switch:~$ nv set system dot1x dynamic-ipv6-multi-tenant state enabled

nv set system dot1x dynamic ipv6-profile <profile-id>

Configures creates an IPv6 profile, which defines the various parts of the IPv6 address prefix.

Command Syntax

Version History

Introduced in Cumulus Linux 5.15.0

Example

cumulus@switch:~$ nv set system dot1x ipv6-profile TENANT-A 

nv set system dot1x ipv6-profile <profile-id> preserve-on-link-down

Preserves the IPv6 addresses when the switch reboots or a link flaps.

Command Syntax

Version History

Introduced in Cumulus Linux 5.16.0

Example

cumulus@switch:~$ nv set system dot1x ipv6-profile TENANT-A preserve-on-link-down enabled

nv set system dot1x dynamic ipv6-profile <profile-id> property <property-name> <option>

Defines the various parts of the IPv6 address prefix for dynamic IPv6 multi-tenancy. You can define the following options in the profile:

• offset is the starting offset of the prefix substring. You can specify a value between 0 and 63.
• length is the length of the prefix substring. You can specify a value between 0 and 64.
• value is a string, integer, or enum of the VSA, or port ID.
• isolation-property is an optional flag to specify if this row is a criterion for tenant isolation. If multiple rows have this flags set, then they are all combined.
• summarize-out specifies that the summary route is advertised. There can be only one row with this flag.

Command Syntax

Version History

Introduced in Cumulus Linux 5.15.0

Example

cumulus@switch:~$ nv set system dot1x ipv6-profile TENANT-A property PREFIX offset 0

nv set system dot1x ipv6-profile <profile-id> route-map</h

Configures a route map with a static protocol match and set the route tag for dynamic IPv6 multi-tenancy.

Command Syntax

Version History

Introduced in Cumulus Linux 5.15.0

Example

cumulus@switch:~$ nv set system dot1x ipv6-profile TENANT-A route-map-tag 911

nv set system dot1x dynamic ipv6-profile <profile-id> route-tag <route-tag>

Sets the route tag for the dynamic IPv6 multi-tenancy profile. This setting is required.

Command Syntax

Version History

Introduced in Cumulus Linux 5.15.0

Example

cumulus@switch:~$ nv set system dot1x ipv6-profile TENANT-A route-tag 911

nv set system dot1x dynamic-vlan

Configures dynamic VLAN assignment globally, where VLAN attributes from the RADIUS server apply to the bridge. You can specify required, disabled, or optional.

If you specify required, when VLAN attributes do not exist in the access response packet from the RADIUS server, the user is not authorized and has no connectivity. If the RADIUS server returns VLAN attributes but the user has an incorrect password, the user goes in the auth-fail VLAN (if you enable auth-fail VLAN).

A common requirement for campus networks is to assign dynamic VLANs to specific users in combination with IEEE 802.1x. After authenticating a supplicant, the user is assigned a VLAN based on the RADIUS configuration. Cumulus Linux assigns the dynamic VLAN by manipulating the PVID of the interface.

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set system dot1x dynamic-vlan required

nv set system dot1x max-stations

Configures the maximum number of authenticated MAC addresses allowed on an interface. You can specify any number between 0 and 255. The default value is 6.

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set system dot1x max-stations 10

nv set system dot1x pre-auth allow-protocol lldp

Configures the switch to allow LLDP packets on unauthorized ports. You can specify ingress, egress, both, or none.

By default, Cumulus Linux blocks LLDP packets on unauthorized ports. If you need to discover the physical topology before 802.1X authentication (for example, in multi-tenant data centers), you can configure the switch to allow LLDP packets on unauthorized ports on ingress, egress, or both.

• This feature only affects ports in the pre-authentication stage.
• Cumulus Linux does not block authenticated ports.
• Link down puts the 802.1x enabled ports in the pre-authentication state.
• When you reboot the switch, the 802.1x enabled ports come up in either blocked or allowed mode based on the configuration.

Version History

Introduced in Cumulus Linux 5.17.0

Example

cumulus@switch:~$ nv set system dot1x pre-auth allow-protocol lldp egress

nv set system dot1x radius client-src-ip

Configures the fixed IP address for the RADIUS client to receive requests.

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set system dot1x radius client-src-ip 10.10.10.6

nv set system dot1x radius nas-identifier

Sets the NAS identifier.

The NAS identifier is a string such as a fully qualified domain name that identifies the NAS to the RADIUS server. The RADIUS server uses the NAS identifier for accounting purposes. On the RADIUS server, the NAS identifier identifies the source NAS. If two or more NAS devices have the same NAS IP address, you can use a different NAS identifier for each of them to uniquely identify them at the RADIUS server. You can specify a maximum of 253 ASCII characters.

Version History

Introduced in Cumulus Linux 5.13.0

Example

cumulus@switch:~$ nv set system dot1x radius nas-identifier AP-123

nv set system dot1x radius nas-ip-address

Sets the NAS IP address.

The NAS IP address is an IPv4 address used only in Access-Request packets from the RADIUS client (the Cumulus switch) to the RADIUS server (not in subsequent packet types, such as Access-Accept, Access-Reject, or Access-Challenge). The RADIUS server uses the NAS IP address for accounting purposes. On the RADIUS server, the NAS IP address identifies the source NAS. If two or more NAS devices have the same NAS IP address, you can use a different NAS identifier for each of them to uniquely identify them at the RADIUS server.

Version History

Introduced in Cumulus Linux 5.13.0

Example

cumulus@switch:~$ nv set system dot1x radius nas-ip-address 10.10.10.3

nv set system dot1x radius server <server-id>

Configures the IP address of the 802.1X RADIUS server.

Command Syntax

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set system dot1x radius server 10.10.10.1

nv set system dot1x radius server <server-id> accounting-port

Configures the 802.1X RADIUS accounting port. You can specify a value between 1 and 65535. The default value is 1813.

Command Syntax

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set system dot1x radius server 10.10.10.1 accounting-port 2812

nv set system dot1x radius server <server-id> authentication-port

Configures the 802.1X RADIUS authentication port. You can specify a value between 1 and 65535. The default value is 1812.

Command Syntax

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set system dot1x radius server 10.10.10.1 authentication-port 2813

nv set system dot1x radius server <server-id> priority

Configures the 802.1X RADIUS server priority. You can specify a value between 1 and 3. The default setting is 1.

Command Syntax

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set system dot1x radius server 10.10.10.1 priority 2

nv set system dot1x radius server <server-id> shared-secret

Configures the 802.1X RADIUS shared secret for authentication.

Command Syntax

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set system dot1x radius server 10.10.10.1 shared-secret mysecret

nv set system dot1x radius server <server-id> vrf

Configures the VRF for outgoing RADIUS accounting and authorization packets.

Command Syntax

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set system dot1x radius server 10.10.10.1 vrf BLUE

nv set system dot1x reauthentication-interval

Configures the reauthentication interval for EAP. You can set a value between 0 and 86640. The default value is 0 (disabled).

This setting only applies to EAP-based authentication; it does not apply to MBA.

Version History

Introduced in Cumulus Linux 5.7.0

Example

cumulus@switch:~$ nv set system dot1x reauthentication-interval 40

nv set system dot1x reauth-timeout-ignore

Configures the switch to ignore reauthentication timeout and retain supplicant entries in the database with the Authorized state even if reauthentication fails.

When you set the reauthentication interval for EAP-based authentication (described above), each supplicant reauthenticates with the RADIUS server through the switch after the interval expires. If reauthentication fails, the entry for this supplicant is removed from the database (in addition, you do not see the supplicant in the nv show interface dot1x-summary output).

Set this command to yes to retain the entry in the database with the Authorized state even if reauthentication fails because the RADIUS server is unreachable or times out.

Version History

Introduced in Cumulus Linux 5.13.0

Example

cumulus@switch:~$ nv set system dot1x reauth-timeout-ignore yes

nv set system dot1x tx-identity-request delay

Sets the identity-request delay, which is the number of seconds to wait after a link-up event before sending the first EAP Identity Request. You can set a value between 1 and 60. The default value is 1 second.

Version History

Introduced in Cumulus Linux 5.16.0

Example

cumulus@switch:~$ nv set system dot1x tx-identity-request delay 10

nv set system dot1x tx-identity-request interval

Sets the identity-request interval, which is the frequency in seconds at which EAP Identity Requests are sent until the switch detects a supplicant. You can set a value between 1 and 3600. The default value is 30 seconds.

Version History

Introduced in Cumulus Linux 5.16.0

Example

cumulus@switch:~$ nv set system dot1x tx-identity-request interval 10 

nv set system dot1x tx-identity-request max-retries

Sets the maximum number of multicast EAPOL identity request retries. By default, the switch sends retries indefinitely at 30-second intervals until at least one supplicant responds to an EAPOL identity request with an EAP identity response. You can set a value between 0 and 65535.

Version History

Introduced in Cumulus Linux 5.17.0

Example

cumulus@switch:~$ nv set system dot1x tx-identity-request max-retries 50 

nv set system dot1x tx-identity-request state

Sets 802.1X reauthentication to ensure that the switch revalidates connected clients for authorization and security after a port flap or switch reboot. When a port goes down and comes back up, reauthentication:

• Confirms the connected device is still authorized to access the network.
• Prevents unauthorized or stale sessions from remaining active.
• Ensures security policies reapply correctly.
• Maintains network access control integrity after link disruptions.

802.1X reauthentication is disabled by default.

Version History

Introduced in Cumulus Linux 5.16.0

Example

cumulus@switch:~$ nv set system dot1x tx-identity-request state enabled