Cisco Catalyst 4500 Series Software Configuration Guide

49-61
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
Note Removing a 802.1X MAB configuration from a port does not impact the authorized or authenticated
state of the port. If the port is in an unauthenticated state, it remains in that state. If the port is in an
authenticated state because of MAB, the switch reverts to the 802.1X Authenticator. If the port was
already authorized with a MAC address and the MAB configuration was removed, the port remains in
an authorized state until reauthentication occurs. At that time, if an 802.1X supplicant is detected on the
wire, the MAC address is removed.
This example shows how to enable MAB on Gigabit Ethernet interface 3/3 and to verify the configuration:
Cisco IOS Release 12.2(50)SG and later
Switch# configure terminal
Switch(config)# interface gigabitethernet3/3
Switch(config-if)# switchport mode access
Switch(config-if)# dot1x pae authenticator
Switch(config-if)# authentication port-control auto
Switch(config-if)# mab
Switch(config-if)# end
Switch# show mab int g3/3 details
MAB details for GigabitEthernet3/3
-------------------------------------
Mac-Auth-Bypass = Enabled
MAB Client List
---------------
Client MAC = 0001.0001.0001
Session ID = C0A8016F0000002304175914
MAB SM state = TERMINATE
Auth Status = AUTHORIZED
Step 4
Switch(config-if)# dot1x pae
authenticator
Enables 802.1X authentication on the port with default parameters.
Refer to the “Default 802.1X Configuration” section on page 49-27.
Step 5
Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# authentication
port-control auto
Cisco IOS Release 12.2(46)SG or earlier
releases
Switch(config-if)# dot1x
port-control auto
Enables 802.1X authentication on the interface.
Step 6
Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# mab [eap]
Cisco IOS Release 12.2(46)SG or earlier
releases
Switch(config-if)# dot1x
mac-auth-bypass [eap]
Enables MAB on a switch.
The eap option specifies that a complete EAP conversation should be
used, as opposed to standard RADIUS Access-Request, Access-Accept
conversation. By default, the eap option is not enabled for MAB.
Step 7
Switch(config)# end
Returns to privileged EXEC mode.
Step 8
Switch# show mab interface
interface-id details
(Optional) Verifies your entries.
Step 9
Switch# copy running-config
startup-config
(Optional) Saves your entries in the configuration file.
Command Purpose

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E