Cisco Catalyst 4500 Series Administration Guide

46-9
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 46 Configuring 802.1X Port-Based Authentication
About 802.1X Port-Based Authentication
Figure 46-5 Multidomain Authentication Mode Example
Figure 46-5 shows a typical MDA application with a single host behind an IP phone connected to the
802.1X-enabled port. Because the client is not directly connected to the switch, the switch cannot detect
a loss of port link if the client is disconnected. To prevent another device from using the established
authentication of the disconnected client later, Cisco IP phones send a Cisco Discovery Protocol (CDP)
host presence type length value (TLV) to notify the switch of changes in the attached client’s port link
state.
For details on how to configure MDA, see the “Using Multiple Domain Authentication and Multiple
Authentication” section on page 46-24.
Multiauthentication Mode
Available starting in Cisco IOS Release 12.2(50)SG, multiauthentication mode allows one client on the
voice VLAN and multiple authenticated clients on the data VLAN. When a hub or access point is
connected to an 802.1X port, multiauthentication mode provides enhanced security over multiple-hosts
mode by requiring authentication of each connected client. For non-802.1X devices, you can use MAB
or web-based authentication as the fallback method for individual host authentications, allowing you to
authenticate different hosts through different methods on a single port.
Multiauthentication also supports MDA functionality on the voice VLAN by assigning authenticated
devices to either a data or voice VLAN depending on the VSAs received from the authentication server.
Note When a port is in multiauthentication mode, Guest VLAN and Authentication Failed VLAN will not
activate for data devices.
Pre-authentication Open Access
Beginning with Cisco IOS Release 12.2(50)SG, any of the four host modes can be additionally
configured to allow a device to gain network access before authentication. This preauthentication open
access is useful in an application such as the Pre-boot eXecution Environment (PXE), where a device
must access the network to download a bootable image containing an authentication client.
Enable preauthentication open access by entering the authentication open command after host mode
configuration. It acts as an extension to the configured host mode. For example, if preauthentication open
access is enabled with single-host mode, then the port allows only one MAC address. When
preauthentication open access is enabled, initial traffic on the port is restricted only by whatever other
access restriction, independent of 802.1X, is configured on the port. If no access restriction other than
802.1X is configured on the port, then a client device has full access on the configured VLAN.
802.1X Violation Mode
You can use the authentication violation interface configuration command to configure the violation
mode: restrict, shutdown, and replace.
IP
Client IP phone Switch
Authentication
server
(RADIUS)
187640

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E