46-90
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 46 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
• Configuring NEAT with ASP, page 46-94
• Configuration Guidelines, page 46-94
Note For overview information, see the “802.1X Supplicant and Authenticator Switches with Network Edge
Access Topology” section on page 46-26.
Configuring Switch as an Authenticator
To configure a switch as an authenticator, perform this task:
When CISP is enabled on a trunk port, the following features are inert. When CISP is neither running
nor configured, these features operate as expected:
• VLAN assignment
• Guest, Authentication Failure, voice, and critical VLANs
• Critical authentication
• Wake-on-LAN
• Web authentication
• Port security
• Violation modes (restrict, shut down, and shut down VLAN)
The following example shows how to enable CISP on a port. You must configure the following procedure
in the Cisco ACS server. Configuring a user with Cisco AV Pair value, allows SSW to authenticate itself
with the ASW. Because the user is attached with the AV pair value, upon successful authentication on
ASW, the macro is executed on the interface on which SSW is authenticated:
Switch# configure terminal
Switch(config)# cisp enable
Command Purpose
Step 1
Switch# configure terminal
Enters global configuration mode.
Step 2
Switch(config)# cisp enable
Enables CISP.
Step 3
Switch(config)# interface
interface-id
Specifies the port to be configured, and enter interface configuration
mode.
Step 4
Switch(config-if)# switchport mode
access
Sets the port mode to access.
Step 5
Switch(config-if)# authentication
port-control auto
Sets the port-authentication mode to auto.
Step 6
Switch(config-if)# dot1x pae
authenticator
Configures the interface as a port access entity (PAE) authenticator.
Step 7
Switch(config-if)# spanning-tree
portfast
Enables Port Fast on an access port connected to a single workstation or
server.
Step 8
Switch(config-if)# end
Returns to privileged EXEC mode.
Step 9
Switch# show running-config
interface
interface-id
Verifies your configuration.
Step 10
Switch# copy running-config
startup-config
(Optional) Saves your entries in the configuration file.
To Next Page
Loading...
