Exhibit.

In Junos OS, the supplicant-mode configuration under protocols dot1x determines how the switch handles multiple MAC addresses on a single physical port. According to the exhibit, the current mode is set toSingle, and theNumber of connected supplicantsis2. This indicates thatthe port is currently allowing multiple devices, which contradicts the goal of limiting access to only one device at a time.

Here is the breakdown of whyOption Cis the correct solution based on Juniper’s standard behavior:

Supplicant Mode: Single (Current State):In this mode, the first device to authenticate opens the port for all subsequent devices. As long as the first device remains authenticated, other devices can send traffic through the port without individual authentication. This is why the exhibit shows 2 connected supplicants despite the mode being "Single."

Supplicant Mode: Single-Secure (The Solution):This mode strictly limits the port toonly oneMAC address. Once a device successfully authenticates via 802.1X, the switch drops any traffic coming from any other MAC address on that port. If the authenticated device logs off or the session times out, the port becomes available for a new device, but never more than one simultaneously. *Supplicant Mode: Multiple (Option B):This mode allows multiple supplicants to authenticate individually. Each MAC address must go through its own authentication process. This would allow more than one device, which is the opposite of the user's requirement.

MAC RADIUS Restrict (Option A):This feature is used to force MAC-based authentication and does not inherently limit the number of devices to one in the same way that changing the supplicant mode does.

Maximum EAPOL requests (Option D):This parameter defines how many times the switch will send an EAP-Request/Identity frame to a supplicant before giving up. Changing this to 1 does not restrict the number of devices allowed on the port; it only changes the retry logic for a single authentication attempt.

Configuration Example for Junos OS 24.4:To implement this change, you would use the following command: set protocols dot1x edit interface ge-0/0/10.0 supplicant-mode single-secure