Cisco Catalyst 4500 Series - Cisco AV Pair Configuration

46-91
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 46 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
Switch(config)# interface GigabitEthernet5/23
Switch(config-if)# switchport mode access
Switch(config-if)# spanning-tree portfast
Switch(config-if)# dot1x pae authenticator
Switch(config-if)# authentication port-control auto
Cisco AV Pair Configuration
Next, you need to configure a Cisco AV pair value.
Log into ACS, and Select/Create a User. Go to User Setup and scroll down to the [009\001]
cisco-av-pair Tab. Enter device-traffic-class=switch (Figure 46-17).
Figure 46-17 Specifying the Cisco AV Pair
Starting with Cisco IOS XE Release 3.2.0 SG (15.0(2)SG) the spanning-tree bpduguard feature is
automatically disabled or enabled as part of a macro provided it was previously enabled in the port
configuration. If the configuration did not have BPDU Guard enabled before the supplicant switch was
authenticated, the spanning-tree bpduguard feature is not applied to the macro.
Note Disabling spanning-tree bpduguard happens only if it was previously enabled through the port level
command. Enabling it globally without a specific port level CLI prevents NEAT from disabling it on the
port after the authenticator switch receives a device-traffic-class=switch AV Pair and applies the macro.
There are 2 scenarios:
Scenario 1: With Port Level BPDU Guard Configuration
Before Authorization