Cisco Catalyst 4500 Series Administration Guide

46-5
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 46 Configuring 802.1X Port-Based Authentication
About 802.1X Port-Based Authentication
Figure 46-2 Message Exchange
Ports in Authorized and Unauthorized States
The switch port state determines whether the client is granted access to the network. The port starts in
the unauthorized state. While in this state, the port disallows all ingress and egress traffic except for
802.1X protocol packets. When a client is successfully authenticated, the port transitions to the
authorized state, allowing all traffic for the client to flow normally.
If a non-802.1X capable client is connected to an unauthorized 802.1X port, the switch requests the
client’s identity. In this situation, the client does not respond to the request, the port remains in the
unauthorized state, and the client is not granted access to the network. If a guest VLAN is configured on
a port that connects to a client that does not support 802.1X, the port is placed in the configured guest
VLAN and in the authorized state. For more information, see the “Using 802.1X for Guest VLANs”
section on page 46-12.
In contrast, when an 802.1X-enabled client connects to a port that is not running the 802.1X protocol,
the client initiates the authentication process by sending the EAPOL-start frame. When no response is
received, the client sends the request a fixed number of times. Because no response is received, the client
begins sending frames as if the port is in the authorized state.
You can control the port authorization state by using the authentication port-control interface
configuration command (dot1x port-control auto command in Cisco IOS Release 12.2(46)SG and
earlier releases) and these keywords:
• force-authorized—Disables 802.1X authentication and causes the port to transition to the
authorized state without requiring authentication exchange. The port transmits and receives normal
traffic without 802.1X-based authentication of the client. This setting is the default.
• force-unauthorized—Causes the port to remain in the unauthorized state, ignoring all attempts by
the client to authenticate. The switch cannot provide authentication services to the client using the
interface.
Port Authorized
Port Unauthorized
Authenticator
EAPOL-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/OTP
EAP-Response/OTP
EAP-Success
RADIUS Access-Request
RADIUS Access-Challenge
RADIUS Access-Request
RADIUS Access-Accept
EAPOL-Logoff
94159
Supplicant Authentication
server
Client
Workstation
Catalyst 4500 Network
Access Switch
RADIUS

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E