Cisco Catalyst 2960-XR User Manual

•
To authorize a voice device, the AAA server must be configured to send a Cisco Attribute-Value (AV)
pair attribute with a value of device-traffic-class=voice. Without this value, the switch treats the voice
device as a data device.
•
The guest VLAN and restricted VLAN features only apply to the data devices on an MDA-enabled port.
The switch treats a voice device that fails authorization as a data device.
•
If more than one device attempts authorization on either the voice or the data domain of a port, it is error
disabled.
•
Until a device is authorized, the port drops its traffic. Non-Cisco IP phones or voice devices are allowed
into both the data and voice VLANs. The data VLAN allows the voice device to contact a DHCP server
to obtain an IP address and acquire the voice VLAN information. After the voice device starts sending
on the voice VLAN, its access to the data VLAN is blocked.
•
A voice device MAC address that is binding on the data VLAN is not counted towards the port security
MAC address limit.
•
You can use dynamic VLAN assignment from a RADIUS server only for data devices.
•
MDA can use MAC authentication bypass as a fallback mechanism to allow the switch port to connect
to devices that do not support IEEE 802.1x authentication.
•
When a data or a voice device is detected on a port, its MAC address is blocked until authorization
succeeds. If the authorization fails, the MAC address remains blocked for 5 minutes.
•
If more than five devices are detected on the data VLAN or more than one voice device is detected on
the voice VLAN while a port is unauthorized, the port is error disabled.
•
When a port host mode is changed from single- or multihost to multidomain mode, an authorized data
device remains authorized on the port. However, a Cisco IP phone that has been allowed on the port
voice VLAN is automatically removed and must be reauthenticated on that port.
•
Active fallback mechanisms such as guest VLAN and restricted VLAN remain configured after a port
changes from single- or multihost mode to multidomain mode.
•
Switching a port host mode from multidomain to single- or multihost mode removes all authorized
devices from the port.
•
If a data domain is authorized first and placed in the guest VLAN, non-IEEE 802.1x-capable voice
devices need to tag their packets on the voice VLAN to trigger authentication.
•
We do not recommend per-user ACLs with an MDA-enabled port. An authorized device with a per-user
ACL policy might impact traffic on both the voice and data VLANs of the port. If used, only one device
on the port should enforce per-user ACLs.
802.1x Supplicant and Authenticator Switches with Network Edge Access
Topology (NEAT)
The Network Edge Access Topology (NEAT) feature extends identity to areas outside the wiring closet (such
as conference rooms). This allows any type of device to authenticate on the port.
•
802.1x switch supplicant: You can configure a switch to act as a supplicant to another switch by using
the 802.1x supplicant feature. This configuration is helpful in a scenario, where, for example, a switch
is outside a wiring closet and is connected to an upstream switch through a trunk port. A switch configured
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 241
Configuring IEEE 802.1x Port-Based Authentication
802.1x Supplicant and Authenticator Switches with Network Edge Access Topology (NEAT)

Cisco Catalyst 2960-XR Specifications

General

Stacking Bandwidth	80 Gbps
Layer Support	Layer 2 and Layer 3
Jumbo Frame Support	9198 bytes
RAM	512 MB
Input Voltage	100-240V AC
Model	Catalyst 2960-XR
Uplink Interfaces	4 x 1G SFP or 2 x 10G SFP+
Downlink Interfaces	24 or 48 x Gigabit Ethernet ports
Power Supply	Internal
MAC Address Table Size	16, 000 entries
PoE	Available on PoE models
Weight	4.5 kg
Features	energy efficiency
Stacking	Up to 8 switches
Operating Temperature	0 to 45°C