Scenario:
Make: Dell Switches
Model: Dell EMC N-Series (N4032, N2048, N3048 etc.)
Server: RADIUS / NPS on Windows Server 2012, 2016, 2019, 2022
Mode: Command Line Interface [CLI]
Description: In this article, we will discuss the step-by-step method to bypass, force authorize, force unauthorize, or set mac-based or auto RADIUS (802.1X) authentication on an interface of a Dell switch. The same commands work on other Dell N-Series switch models.
RADIUS authentication on a switch port (802.1X, or dot1x) checks every device against a RADIUS server before it can use the network. RADIUS configuration on a Dell switch adds an extra layer of security. To avoid downtime when one server is unavailable, RADIUS failover configuration on Dell switches is also recommended.
However, sometimes a port needs different behavior. For example, a printer or camera that does not support 802.1X must be bypassed, or a port must be blocked completely. The dot1x port-control command controls this per interface.
Dot1x Port-Control Modes at a Glance
| Mode | What It Does | Typical Use |
| force-authorized | Port is always allowed, with no RADIUS check | Bypass for printers, cameras, servers |
| force-unauthorized | Port is always blocked, even if the device could authenticate | Disable access on a port |
| auto | The port is authorized only after successful RADIUS authentication | Standard secured access port |
| mac-based | Each device (MAC address) on the port authenticates separately | IP phone with a PC behind it, or multiple devices on one port |
A typical interface configured for RADIUS authentication is shown below.
interface gigabitethernet 1/0/1
description "2 Devices can connect"
switchport voice detect auto
spanning-tree portfast
switchport mode general
dot1x port-control mac-based
dot1x reauthentication
dot1x timeout re-authperiod 86400
dot1x unauth-vlan 200
dot1x max-users 2
dot1x mac-auth-bypass
Important Note: The dot1x max-users command limits the number of devices per port and applies in mac-based mode. For that reason, the example above uses mac-based to allow two devices, such as a phone and a PC.
Login and Enter Configuration Mode
Step 1: Login
Log in to the switch, enter privileged mode, and then go to configuration mode. All the sections below start from here.
login as: edledge
Password: ********
edledge-switch>enable
Password: ********
edledge-switch#configure terminal
edledge-switch(config)#
1. Bypass RADIUS Authentication (Force Authorized)
To bypass RADIUS on a port, set it to force-authorized. The device connects without any RADIUS check. Assign the VLAN the device should use. Because the port is in general mode, use switchport general pvid rather than switchport access vlan.
edledge-switch(config)#interface gigabitethernet 1/0/1
edledge-switch(config-if)#switchport general allowed vlan add 5 untagged
edledge-switch(config-if)#switchport general pvid 5
edledge-switch(config-if)#dot1x port-control force-authorized
edledge-switch(config-if)#exit
edledge-switch(config)#
Important Note: The command no dot1x port-control does not always bypass RADIUS. It returns the port to the switch’s default mode, which may still require authentication. Use force-authorized to bypass RADIUS reliably, and confirm the result with the verification command below.
2. Force Unauthorize RADIUS Authentication
To block a port completely, set it to force-unauthorized. No device can use this port, even if it would pass RADIUS authentication.
edledge-switch(config)#interface gigabitethernet 1/0/1
edledge-switch(config-if)#dot1x port-control force-unauthorized
edledge-switch(config-if)#exit
edledge-switch(config)#
3. Mac-Based RADIUS Authentication
In mac-based mode, every device on the port authenticates separately. This is the right choice when an IP phone and a PC share one port, or when multiple devices connect through a small switch.
edledge-switch(config)#interface gigabitethernet 1/0/1
edledge-switch(config-if)#dot1x port-control mac-based
edledge-switch(config-if)#dot1x max-users 2
edledge-switch(config-if)#exit
edledge-switch(config)#
4. Auto RADIUS Authentication
In auto mode, the port stays blocked until the connected device authenticates successfully with the RADIUS server. Use this mode to return a bypassed or blocked port to normal 802.1X authentication.
edledge-switch(config)#interface gigabitethernet 1/0/1
edledge-switch(config-if)#dot1x port-control auto
edledge-switch(config-if)#exit
edledge-switch(config)#
Verify and Save the Configuration
Check the 802.1X status of the interface, and then save the configuration so that it stays after a reboot.
edledge-switch(config)#exit
edledge-switch#show dot1x interface gigabitethernet 1/0/1
edledge-switch#show running-config interface gigabitethernet 1/0/1
edledge-switch#copy running-config startup-config
Using the methods above, you can change how RADIUS authentication works on any interface of a Dell switch as per your requirement.
Other Important Topics
- RADIUS Bypass/Authorize/Unauthorize On Cisco Switch Interface
- Radius Configuration On Dell Switch
- Radius Failover Configuration On Dell Switch
- How to Change Radius Priority on Dell Switch
- Dell N4000 Series Switch Stack Firmware Upgrade
Disclaimer: This article is for educational purposes only and is not professional financial, medical, or legal advice. It may contain affiliate links, which earn us a small commission at no extra cost to you. See our Disclaimer and Affiliate Disclosure.
Article ID: EA00082