Dell Switch 802.1X Port-Control: Bypass, Force Authorize & More

Scenario:
Make: Dell Switches
Model: Dell EMC N-Series (N4032, N2048, N3048 etc.)
Server: RADIUS / NPS on Windows Server 2012, 2016, 2019, 2022
Mode: Command Line Interface [CLI]
Description: In this article, we will discuss the step-by-step method to bypass, force authorize, force unauthorize, or set mac-based or auto RADIUS (802.1X) authentication on an interface of a Dell switch. The same commands work on other Dell N-Series switch models.

RADIUS authentication on a switch port (802.1X, or dot1x) checks every device against a RADIUS server before it can use the network. RADIUS configuration on a Dell switch adds an extra layer of security. To avoid downtime when one server is unavailable, RADIUS failover configuration on Dell switches is also recommended.

However, sometimes a port needs different behavior. For example, a printer or camera that does not support 802.1X must be bypassed, or a port must be blocked completely. The dot1x port-control command controls this per interface.

Dot1x Port-Control Modes at a Glance

Mode	What It Does	Typical Use
force-authorized	Port is always allowed, with no RADIUS check	Bypass for printers, cameras, servers
force-unauthorized	Port is always blocked, even if the device could authenticate	Disable access on a port
auto	The port is authorized only after successful RADIUS authentication	Standard secured access port
mac-based	Each device (MAC address) on the port authenticates separately	IP phone with a PC behind it, or multiple devices on one port

A typical interface configured for RADIUS authentication is shown below.

interface gigabitethernet 1/0/1
description "2 Devices can connect"
switchport voice detect auto
spanning-tree portfast
switchport mode general
dot1x port-control mac-based
dot1x reauthentication
dot1x timeout re-authperiod 86400
dot1x unauth-vlan 200
dot1x max-users 2
dot1x mac-auth-bypass

Important Note: The dot1x max-users command limits the number of devices per port and applies in mac-based mode. For that reason, the example above uses mac-based to allow two devices, such as a phone and a PC.

Login and Enter Configuration Mode

Step 1: Login
Log in to the switch, enter privileged mode, and then go to configuration mode. All the sections below start from here.

login as: edledge
Password: ********

edledge-switch>enable
Password: ********
edledge-switch#configure terminal
edledge-switch(config)#

1. Bypass RADIUS Authentication (Force Authorized)

To bypass RADIUS on a port, set it to force-authorized. The device connects without any RADIUS check. Assign the VLAN the device should use. Because the port is in general mode, use switchport general pvid rather than switchport access vlan.

edledge-switch(config)#interface gigabitethernet 1/0/1
edledge-switch(config-if)#switchport general allowed vlan add 5 untagged
edledge-switch(config-if)#switchport general pvid 5
edledge-switch(config-if)#dot1x port-control force-authorized
edledge-switch(config-if)#exit
edledge-switch(config)#

Important Note: The command no dot1x port-control does not always bypass RADIUS. It returns the port to the switch’s default mode, which may still require authentication. Use force-authorized to bypass RADIUS reliably, and confirm the result with the verification command below.

2. Force Unauthorize RADIUS Authentication

To block a port completely, set it to force-unauthorized. No device can use this port, even if it would pass RADIUS authentication.

edledge-switch(config)#interface gigabitethernet 1/0/1
edledge-switch(config-if)#dot1x port-control force-unauthorized
edledge-switch(config-if)#exit
edledge-switch(config)#

3. Mac-Based RADIUS Authentication

In mac-based mode, every device on the port authenticates separately. This is the right choice when an IP phone and a PC share one port, or when multiple devices connect through a small switch.

edledge-switch(config)#interface gigabitethernet 1/0/1
edledge-switch(config-if)#dot1x port-control mac-based
edledge-switch(config-if)#dot1x max-users 2
edledge-switch(config-if)#exit
edledge-switch(config)#

4. Auto RADIUS Authentication

In auto mode, the port stays blocked until the connected device authenticates successfully with the RADIUS server. Use this mode to return a bypassed or blocked port to normal 802.1X authentication.

edledge-switch(config)#interface gigabitethernet 1/0/1
edledge-switch(config-if)#dot1x port-control auto
edledge-switch(config-if)#exit
edledge-switch(config)#

Verify and Save the Configuration

Check the 802.1X status of the interface, and then save the configuration so that it stays after a reboot.

edledge-switch(config)#exit
edledge-switch#show dot1x interface gigabitethernet 1/0/1
edledge-switch#show running-config interface gigabitethernet 1/0/1
edledge-switch#copy running-config startup-config

Using the methods above, you can change how RADIUS authentication works on any interface of a Dell switch as per your requirement.

RADIUS (802.1X) Bypass, Authorize & Unauthorize on Dell Switch Interface