# 802.1X

The `nv unset` commands remove the configuration you set with the equivalent `nv set` commands. This guide only describes an `nv unset` command if it differs from the `nv set` command.

## nv set interface <interface-id> dot1x auth-fail-vlan

Enables or disables auth-fail VLAN on the specified interface. You can specify `enabled` or `disabled`. When you enable auth-fail VLAN, if a non-authorized supplicant tries to communicate with the switch, you can route traffic from that device to a different VLAN and associate that VLAN with one of the switch ports to which the supplicant attaches. Cumulus Linux assigns the auth-fail VLAN by manipulating the PVID of the interface.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface you want to configure.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set interface swp1 dot1x auth-fail-vlan enabled

## nv set interface <interface-id> dot1x eap

Enables or disables 802.1X on the specified interfaces. You can specify `enabled` or `disabled`.

The IEEE 802.1X protocol provides a way to authenticate a client (called a supplicant) over wired media. It also provides access for individual MAC addresses on a switch (called the authenticator) after an authentication server authenticates the MAC addresses. The authentication server is typically a RADIUS server.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface you want to configure.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set interface swp1,swp2,swp3 dot1x eap enabled

## nv set interface <interface-id> dot1x host-mode

Configures the 802.1X host mode. You can specify:

- Multi host authenticated mode (`multi-host-authenticated`), where RADIUS must authorize each supplicant to send traffic through the 802.1X interface. This is the default mode.
- Multi host mode ()`multi-host`), where the interface remains closed for all traffic until RADIUS authorizes the first supplicant. After authorization, any host can send and receive traffic through the 802.1X interface as long as the supplicant remains authorized.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface you want to configure.

### Version History

Introduced in Cumulus Linux 5.8.0

### Example

    cumulus@switch:~$ nv set interface swp1 dot1x host-mode multi-host

## nv set interface <interface-id> dot1x mba

Enables or disables MBA for 802.1 X on the specified interface. You can specify `enabled` or `disabled`.

MBA enables bridged interfaces to allow devices to bypass authentication based on their MAC address. This is useful for devices that do not support EAP, such as printers or phones.

You must configure MBA on both the RADIUS server and the RADIUS client (the Cumulus Linux switch).

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface you want to configure.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set interface swp1 dot1x mba enabled

## nv set interface <interface-id> dot1x ipv6-profile <profile-id>

Associates the IPv6 profile that defines the various parts of the IPv6 address prefix with an 802.1X interface for dynamic IPv6 multi-tenancy.

Dynamic IPv6 multi-tenancy using 802.1X authentication integrates RADIUS authentication, address assignment, access control, and routing to provide tenant-specific IPv6 connectivity. Use this feature to isolate tenant traffic in a multi-tenant environment in layer 3 IPv6 and advertise summary routes for the dynamically generated IPv6 addresses.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface you want to configure.

### Version History

Introduced in Cumulus Linux 5.15.0

### Example

    cumulus@switch:~$ nv set interface swp9,swp10 dot1x ipv6-profile TENANT-A

## nv set system dot1x auth-fail-vlan

Configures auth-fail VLAN. You can specify a value between 1 and 4094.

If a non-authorized supplicant tries to communicate with the switch, you can route traffic from that device to a different VLAN and associate that VLAN with one of the switch ports to which the supplicant attaches. Cumulus Linux assigns the auth-fail VLAN by manipulating the PVID of the interface.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set system dot1x auth-fail-vlan 777

## nv set system dot1x dynamic-ipv6-multi-tenant state

Enables and disables dynamic IPv6 multi-tenancy.

Dynamic IPv6 multi-tenancy using 802.1X authentication integrates RADIUS authentication, address assignment, access control, and routing to provide tenant-specific IPv6 connectivity. Use this feature to isolate tenant traffic in a multi-tenant environment in layer 3 IPv6 and advertise summary routes for the dynamically generated IPv6 addresses.

### Version History

Introduced in Cumulus Linux 5.15.0

### Example

    cumulus@switch:~$ nv set system dot1x dynamic-ipv6-multi-tenant state enabled

## nv set system dot1x dynamic ipv6-profile <profile-id>

Configures creates an IPv6 profile, which defines the various parts of the IPv6 address prefix.

### Command Syntax

Syntax | Description
--- | ---
`<profile-id>` | The profile name.

### Version History

Introduced in Cumulus Linux 5.15.0

### Example

    cumulus@switch:~$ nv set system dot1x ipv6-profile TENANT-A

## nv set system dot1x ipv6-profile <profile-id> preserve-on-link-down

Preserves the IPv6 addresses when the switch reboots or a link flaps.

### Command Syntax

Syntax | Description
--- | ---
`<profile-id>` | The profile name.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv set system dot1x ipv6-profile TENANT-A preserve-on-link-down enabled

## nv set system dot1x dynamic ipv6-profile <profile-id> property <property-name> <option>

Defines the various parts of the IPv6 address prefix for dynamic IPv6 multi-tenancy. You can define the following options in the profile:

- `offset` is the starting offset of the prefix substring. You can specify a value between 0 and 63.
- `length` is the length of the prefix substring. You can specify a value between 0 and 64.
- `value` is a string, integer, or enum of the VSA, or port ID.
- `isolation-property` is an optional flag to specify if this row is a criterion for tenant isolation. If multiple rows have this flags set, then they are all combined.
- `summarize-out` specifies that the summary route is advertised. There can be only one row with this flag.

### Command Syntax

Syntax | Description
--- | ---
`<profile-id>` | The profile name.
`<option>` | You can specify `offset`, `length`, `value`, `isolation-property`, or `summarize-out`.

### Version History

Introduced in Cumulus Linux 5.15.0

### Example

    cumulus@switch:~$ nv set system dot1x ipv6-profile TENANT-A property PREFIX offset 0

## nv set system dot1x ipv6-profile <profile-id> route-map</h

Configures a route map with a static protocol match and set the route tag for dynamic IPv6 multi-tenancy.

### Command Syntax

Syntax | Description
--- | ---
`<profile-id>` | The profile name.

### Version History

Introduced in Cumulus Linux 5.15.0

### Example

    cumulus@switch:~$ nv set system dot1x ipv6-profile TENANT-A route-map-tag 911

## nv set system dot1x dynamic ipv6-profile <profile-id> route-tag <route-tag>

Sets the route tag for the dynamic IPv6 multi-tenancy profile. This setting is required.

### Command Syntax

Syntax | Description
--- | ---
`<profile-id>` | The profile name.
`<route-tag>` | The route tag.

### Version History

Introduced in Cumulus Linux 5.15.0

### Example

    cumulus@switch:~$ nv set system dot1x ipv6-profile TENANT-A route-tag 911

## nv set system dot1x dynamic-vlan

Configures dynamic VLAN assignment globally, where VLAN attributes from the RADIUS server apply to the bridge. You can specify `required`, `disabled`, or `optional`.

If you specify `required`, when VLAN attributes do not exist in the access response packet from the RADIUS server, the user is not authorized and has no connectivity. If the RADIUS server returns VLAN attributes but the user has an incorrect password, the user goes in the auth-fail VLAN (if you enable auth-fail VLAN).

A common requirement for campus networks is to assign dynamic VLANs to specific users in combination with IEEE 802.1x. After authenticating a supplicant, the user is assigned a VLAN based on the RADIUS configuration. Cumulus Linux assigns the dynamic VLAN by manipulating the PVID of the interface.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set system dot1x dynamic-vlan required

## nv set system dot1x max-stations

Configures the maximum number of authenticated MAC addresses allowed on an interface. You can specify any number between 0 and 255. The default value is 6.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set system dot1x max-stations 10

## nv set system dot1x radius client-src-ip

Configures the fixed IP address for the RADIUS client to receive requests.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set system dot1x radius client-src-ip 10.10.10.6

## nv set system dot1x radius nas-identifier

Sets the NAS identifier.

The NAS identifier is a string such as a fully qualified domain name that identifies the NAS to the RADIUS server. The RADIUS server uses the NAS identifier for accounting purposes. On the RADIUS server, the NAS identifier identifies the source NAS. If two or more NAS devices have the same NAS IP address, you can use a different NAS identifier for each of them to uniquely identify them at the RADIUS server. You can specify a maximum of 253 ASCII characters.

You must provide the NAS identifier and, or, the NAS IP address when configuring 802.1x interfaces.

### Version History

Introduced in Cumulus Linux 5.13.0

### Example

    cumulus@switch:~$ nv set system dot1x radius nas-identifier AP-123

## nv set system dot1x radius nas-ip-address

Sets the NAS IP address.

The NAS IP address is an IPv4 address used only in Access-Request packets from the RADIUS client (the Cumulus switch) to the RADIUS server (not in subsequent packet types, such as Access-Accept, Access-Reject, or Access-Challenge). The RADIUS server uses the NAS IP address for accounting purposes. On the RADIUS server, the NAS IP address identifies the source NAS. If two or more NAS devices have the same NAS IP address, you can use a different NAS identifier for each of them to uniquely identify them at the RADIUS server.

You must provide the NAS IP address and, or, the NAS identifier when configuring 802.1x interfaces.

### Version History

Introduced in Cumulus Linux 5.13.0

### Example

    cumulus@switch:~$ nv set system dot1x radius nas-ip-address 10.10.10.3

## nv set system dot1x radius server <server-id>

Configures the IP address of the 802.1X RADIUS server.

### Command Syntax

Syntax | Description
--- | ---
`<server-id>` | The IP address of the 802.1X RADIUS server.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set system dot1x radius server 10.10.10.1

## nv set system dot1x radius server <server-id> accounting-port

Configures the 802.1X RADIUS accounting port. You can specify a value between 1 and 65535. The default value is 1813.

### Command Syntax

Syntax | Description
--- | ---
`<server-id>` | The IP address of the 802.1X RADIUS server.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set system dot1x radius server 10.10.10.1 accounting-port 2812

## nv set system dot1x radius server <server-id> authentication-port

Configures the 802.1X RADIUS authentication port. You can specify a value between 1 and 65535. The default value is 1812.

### Command Syntax

Syntax | Description
--- | ---
`<server-id>` | The IP address of the 802.1X RADIUS server.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set system dot1x radius server 10.10.10.1 authentication-port 2813

## nv set system dot1x radius server <server-id> priority

Configures the 802.1X RADIUS server priority. You can specify a value between 1 and 3. The default setting is 1.

### Command Syntax

Syntax | Description
--- | ---
`<server-id>` | The IP address of the 802.1X RADIUS server.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set system dot1x radius server 10.10.10.1 priority 2

## nv set system dot1x radius server <server-id> shared-secret

Configures the 802.1X RADIUS shared secret for authentication.

### Command Syntax

Syntax | Description
--- | ---
`<server-id>` | The IP address of the 802.1X RADIUS server.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set system dot1x radius server 10.10.10.1 shared-secret mysecret

## nv set system dot1x radius server <server-id> vrf

Configures the VRF for outgoing RADIUS accounting and authorization packets.

### Command Syntax

Syntax | Description
--- | ---
`<server-id>` | The IP address of the 802.1X RADIUS server.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set system dot1x radius server 10.10.10.1 vrf BLUE

## nv set system dot1x reauthentication-interval

Configures the reauthentication interval for EAP. You can set a value between 0 and 86640. The default value is 0 (disabled).

This setting only applies to EAP-based authentication; it does not apply to MBA.

### Version History

Introduced in Cumulus Linux 5.7.0

### Example

    cumulus@switch:~$ nv set system dot1x reauthentication-interval 40

## nv set system dot1x reauth-timeout-ignore

Configures the switch to ignore reauthentication timeout and retain supplicant entries in the database with the Authorized state even if reauthentication fails.

When you set the reauthentication interval for EAP-based authentication (described above), each supplicant reauthenticates with the RADIUS server through the switch after the interval expires. If reauthentication fails, the entry for this supplicant is removed from the database (in addition, you do not see the supplicant in the `nv show interface dot1x-summary` output).

Set this command to `yes` to retain the entry in the database with the Authorized state even if reauthentication fails because the RADIUS server is unreachable or times out.

### Version History

Introduced in Cumulus Linux 5.13.0

### Example

    cumulus@switch:~$ nv set system dot1x reauth-timeout-ignore yes

## nv set system dot1x tx-identity-request delay

Sets the identity-request delay, which is the number of seconds to wait after a link-up event before sending the first EAP Identity Request. You can set a value between 1 and 60. The default value is 1 second.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv set system dot1x tx-identity-request delay 10

## nv set system dot1x tx-identity-request interval

Sets the identity-request interval, which is the frequency in seconds at which EAP Identity Requests are sent until the switch detects a supplicant. You can set a value between 1 and 3600. The default value is 30 seconds.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv set system dot1x tx-identity-request interval 10

## nv set system dot1x tx-identity-request state

Sets 802.1X reauthentication to ensure that the switch revalidates connected clients for authorization and security after a port flap or switch reboot. When a port goes down and comes back up, reauthentication:

- Confirms the connected device is still authorized to access the network.
- Prevents unauthorized or stale sessions from remaining active.
- Ensures security policies reapply correctly.
- Maintains network access control integrity after link disruptions.

802.1X reauthentication is disabled by default.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv set system dot1x tx-identity-request state enabled