If a client is denied access - either because the RADIUS server denies the client access or because the RADIUS server request times out - the client is put on hold in the Unauthorized state. The hold timer does not count during an on-going authentication. In MAC-based Auth. mode, the switch will ignore new frames coming from the client during the hold time. Admin State supported : Single, Multi and MAC-Based Auth. 802.1X. range: 10 - 1000000 seconds.