1-24
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-25303-03
Chapter 1 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
Feature Interactions
• Guest VLAN—Inaccessible authentication bypass is compatible with guest VLAN. When a guest
VLAN is enabled on 8021.x port, the features interact as follows:
–
If at least one RADIUS server is available, the switch assigns a client to a guest VLAN when
the switch does not receive a response to its EAP request/identity frame or when EAPOL
packets are not sent by the client.
–
If all the RADIUS servers are not available and the client is connected to a critical port, the
switch authenticates the client and puts the critical port in the critical-authentication state in the
RADIUS-configured or user-specified access VLAN.
–
If all the RADIUS servers are not available and the client is not connected to a critical port, the
switch might not assign clients to the guest VLAN if one is configured.
–
If all the RADIUS servers are not available and if a client is connected to a critical port and was
previously assigned to a guest VLAN, the switch keeps the port in the guest VLAN.
• Restricted VLAN—If the port is already authorized in a restricted VLAN and the RADIUS servers
are unavailable, the switch puts the critical port in the critical-authentication state in the restricted
VLAN.
• 802.1x accounting—Accounting is not affected if the RADIUS servers are unavailable.
• Private VLAN—You can configure inaccessible authentication bypass on a private VLAN host port.
The access VLAN must be a secondary private VLAN.
• Voice VLAN—Inaccessible authentication bypass is compatible with voice VLAN, but the
RADIUS-configured or user-specified access VLAN and the voice VLAN must be different.
• Remote Switched Port Analyzer (RSPAN)—Do not configure an RSPAN VLAN as the
RADIUS-configured or user-specified access VLAN for inaccessible authentication bypass.
In a switch stack, the stack master checks the status of the RADIUS servers by sending keepalive
packets. When the status of a RADIUS server changes, the stack master sends the information to the
stack members. The stack members can then check the status of RADIUS servers when re-authenticating
critical ports.
If the new stack master is elected, the link between the switch stack and RADIUS server might change,
and the new stack immediately sends keepalive packets to update the status of the RADIUS servers. If
the server status changes from dead to alive, the switch re-authenticates all switch ports in the
critical-authentication state.
When a member is added to the stack, the stack master sends the member the server status.
802.1x Critical Voice VLAN Configuration
When an IP phone connected to a port is authenticated by the access control server (ACS), the phone is
put into the voice domain. If the ACS is not reachable, the switch cannot determine if the device is a
voice device. If the server is unavailable, the phone cannot access the voice network and therefore cannot
operate.
For data traffic, you can configure inaccessible authentication bypass, or critical authentication, to allow
traffic to pass through on the native VLAN when the server is not available. If the RADIUS
authentication server is unavailable (down) and inaccessible authentication bypass is enabled, the switch
grants the client access to the network and puts the port in the critical-authentication state in the
RADIUS-configured or the user-specified access VLAN. When the switch cannot reach the configured
To Next Page
Loading...
Need help?
General
