Tuning port access on AOS-CX: client limits, violations, timers and operational commands

Notes from reading documentation, not results from testing on a live system. Main source: HPE’s ArubaOS-CX 10.04 Security Guide. Each point carries a page citation at the end; anything that could not be verified is marked.

Port access (802.1X and MAC-Auth) on AOS-CX switches has a set of parameters that the product documentation records as default values — know them before a mass rollout¹:

• By default each port accepts only 1 client.
• On a port with authentication enabled and no client authenticated yet, the switch does not let flooded traffic (broadcast, multicast, unknown-destination unicast) out of that port, so Wake-on-LAN cannot reach the machine.
• MAC-Auth, MAC lockout and port security are mutually exclusive on the same port, and a port using any of these methods must have LACP disabled.

The source is the AOS-CX 10.04 product documentation for the 6200/6300/6400 series. Numbers and syntax may have changed in newer releases.

Prerequisites

• Understand the port access role assignment chain on AOS-CX: pre-auth, auth, reject, critical role and the two modes client/device.
• A switch running AOS-CX with a RADIUS server configured, and 802.1X or MAC-Auth enabled both globally and on the port¹.

Steps

1. Clients per port, and what happens when you exceed it

Parameter	Default	Range
aaa authentication port-access client-limit	1	1–256 on 6300/6400, 1–32 on 6200
Hard ceiling	256 clients per port, 16,384 clients per switch, counted across all methods	once 16,384 is reached, no port accepts another client, by any method

Exceeding the limit is a security violation, and the switch handles it according to port-access security violation action¹:

Action	Meaning
notify (default)	only logs the event and sends syslog
shutdown	shuts the port down. The port only comes back on its own if shutdown auto-recovery is enabled (default off), after recovery-timer (default 10 seconds, range 10–600)

To see which ports have violated and how many times: show port-access security violation client-limit-exceeded interface all¹.

Author’s note (unverified): A port with an IP phone and a daisy-chained PC behind it carries two clients. With the 10.04 default of client-limit 1, such a port has to have its limit raised to at least 2, otherwise the second device is a violation: with notify it simply cannot get on, with shutdown the whole port goes down and takes the first device with it.

2. 802.1X and MAC-Auth ordering

Both can be enabled at the same time on one port. The default is 802.1X first, MAC-Auth second; change it per port with aaa authentication port-access auth-precedence mac-auth dot1x, and the no form returns to the default¹.

⚠️ MAC-Auth, MAC lockout and port security are mutually exclusive on the same port, and a port configured with any of these methods must have LACP disabled¹. Port security is a different mechanism; see port security on AOS-CX.

3. Flooded traffic to a port nobody has authenticated on

By default the switch does not let broadcast, multicast and unknown-destination unicast through a security-enabled port that has no authenticated client yet. If you need Wake-on-LAN to wake a machine before it has had a chance to authenticate, enable port-access allow-flood-traffic enable on that port¹.

4. 802.1X timers

Parameter (aaa authentication port-access dot1x authenticator …)	Meaning	Default	Range
discovery-period	how long to wait before resending EAPOL Request-Identity on a port with no client authenticated yet	30 s	1–65535
eapol-timeout	how long to wait for the client to answer before resending EAPOL	computed per RFC 2988: 3 s the first time, doubling each time, capped at 20 s	1–65535 (0 = use the RFC computation)
max-eapol-requests	how many unanswered EAPOL requests before it counts as a failure and the session ends	5	1–10
max-retries	how many authentication attempts before the client is marked unauthenticated	2	1–10
quiet-period	after the last failed attempt, how long the port stops looking for a supplicant	60 s	0–65535
reauth + reauth-period	periodic re-authentication; off by default, enable reauth first and then set the period	3600 s	1–65535
cached-reauth + cached-reauth-period	when RADIUS is unreachable at re-authentication, how long an authenticated client keeps its current attributes	off; 30 s	30–86400
radius server-group	the RADIUS server group used for 802.1X	radius	—

auth-method has only one value, eap-radius¹.

⚠️ Once max-retries is used up, the port stops completely looking for a supplicant for the whole quiet-period (default 60 seconds), and only then tries again¹.

5. MAC-Auth-specific parameters

Parameter (aaa authentication port-access mac-auth …)	Default	Notes
addr-format	no-delimiter (lowercase, no separator)	8 formats: no delimiter, single hyphen, multiple hyphens, colons, each with an uppercase variant. Must match how the RADIUS side stores MACs
auth-method	chap	pap can be chosen. PEAP-MSCHAPv2 is not supported
password	not set	sets one shared password for all MAC-Auth devices, as plaintext or ciphertext
quiet-period	60 s	how long not to retry a client that was just rejected
reauth / reauth-period	off / 3600 s	as for 802.1X
cached-reauth / cached-reauth-period	off / 30 s	as for 802.1X

The documentation describes MAC-Auth as the way in for devices without a supplicant (printers, phones, APs, IoT) and for temporary access; the switch sends the MAC up, and the RADIUS server uses the MAC as both username and password¹. A VLAN assigned by RADIUS wins over the port’s static untagged VLAN¹.

Author’s note (unverified): The password parameter is the switch-side way to make the password in a MAC-Auth request no longer equal to the MAC, which is exactly what RFC 5080 recommends against. The vendor documentation does not connect the two, and does not say what ClearPass must be configured with to match. Test in a lab before changing it at scale, because a server side that checks “password = MAC” will reject everything.

6. Parameters attached to a role

Each local role (port-access role <name>) can carry the following settings; a client placed in a role gets that role’s settings¹:

Setting	Default / range	Notes
client-inactivity timeout	300 s, range 300–4294967295, or none	a client silent past the limit is removed from the role
reauth-period	not set; 1–86400 s	overrides the period configured on the port. Below 60 s is not recommended
session-timeout	1–4294967295 s	the session ends when it expires. Below 60 s is not recommended
auth-mode	client-mode / device-mode	overrides the port’s mode
vlan access / vlan trunk native / vlan trunk allowed	—	VLANs for the role’s clients
associate policy	—	only policies created with port-access policy can be attached; policies created with the regular policy command and downloaded policies cannot be attached to a local role
associate captive-portal-profile	—	the profile must already exist on the switch
gateway-zone zone … gateway-role …	—	for UBT
poe-priority, mtu (68–9198), trust-mode (dscp/cos/none)	—	PoE, MTU and QoS per role

⚠️ A role in use is only built when the switch’s TCAM has room¹.

The pre-auth role in 10.04 is fairly narrow.

The 10.04 documentation puts several concrete limits on the pre-auth role¹:

• It applies only to MAC-Auth clients, not to other methods.
• On one port you can configure either a pre-auth VLAN (voice and/or data) or a pre-auth role, not both.
• More than one tagged or untagged VLAN is not supported.
• It cannot be configured through the WebUI, Menu or REST, only the CLI.
• With RADIUS tracking enabled and no RADIUS server left, the port moves from the pre-auth VLAN to the critical VLAN.

Verification

The view and action commands per the documentation¹:

Command	Used to
show aaa authentication port-access interface all client-status [mac <MAC>]	per client: port, session time, which method authenticated (the Auth Precedence line shows the state of both), the role, and whether the role has been Applied
show aaa authentication port-access dot1x authenticator interface <port> port-statistics	the port’s EAPOL counters: frames received/sent, Start, Logoff, Request-Identity, error frames
show aaa authentication port-access mac-auth interface <port> client-status	MAC-Auth client state
show port-access policy <name> hitcounts {port | client}	packets matched by each line of a port access policy
port-access reauthenticate interface <port>	forces every client on the port to re-authenticate; clients in the HELD state are skipped
port-access log-off client mac <MAC>	kicks one client off the port
clear dot1x authenticator statistics / clear mac-auth statistics	clears the counters before retrying so they are easier to read

Author’s note (unverified): A sensible reading order when a machine cannot get on: check client-status to see which method the switch tried and whether the role is Applied; if the client does not show up, look at the port’s EAPOL counters to see whether the supplicant answers, and only then move to Access Tracker on the ClearPass side. The full diagnosis is in diagnosing 802.1X and RADIUS authentication failures.

Rollback

The parameters above have a no form that returns them to the default value given in the tables (for example no port-access security violation action goes back to notify, no aaa authentication port-access auth-precedence goes back to 802.1X first)¹.

Author’s note (unverified): Changing security violation action to shutdown is the most incident-prone change in this note, because a port going down takes legitimate devices with it. If you must use it, enable auto-recovery as well so the port comes back on its own, and keep notify on ports with daisy-chained devices.

Related

• Port security on AOS-CX

Sources

Footnotes

1. ArubaOS-CX 10.04 Security Guide (6300, 6400 Switch Series) — official HPE product documentation, chapter 16 (Port access), PDF pp. 179–237 ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴ ↩¹⁵ ↩¹⁶