Cisco IE 3000 User Manual

10-23
Cisco IE 3000 Switch Software Configuration Guide
OL-13018-01
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Configuring IEEE 802.1x Authentication
• The readiness check can be sent on a port that handles multiple hosts (for example, a PC that is
connected to an IP phone). A syslog message is generated for each of the clients that respond to the
readiness check within the timer period.
Beginning in privileged EXEC mode, follow these steps to enable the IEEE 802.1x readiness check on
the switch:
This example shows how to enable a readiness check on a switch to query a port. It also shows the
response received from the queried port verifying that the device connected to it is IEEE 802.1x-capable:
switch# dot1x test eapol-capable interface gigabitethernet1/2
DOT1X_PORT_EAPOL_CAPABLE:DOT1X: MAC 00-01-02-4b-f1-a3 on gigabitethernet1/2 is EAPOL
capable
Configuring IEEE 802.1x Authentication
To configure IEEE 802.1x port-based authentication, you must enable authentication, authorization, and
accounting (AAA) and specify the authentication method list. A method list describes the sequence and
authentication method to be queried to authenticate a user.
To allow VLAN assignment, you must enable AAA authorization to configure the switch for all
network-related service requests.
This is the IEEE 802.1x AAA process:
Step 1 A user connects to a port on the switch.
Step 2 Authentication is performed.
Step 3 VLAN assignment is enabled, as appropriate, based on the RADIUS server configuration.
Step 4 The switch sends a start message to an accounting server.
Step 5 Re-authentication is performed, as necessary.
Step 6 The switch sends an interim accounting update to the accounting server that is based on the result of
re-authentication.
Step 7 The user disconnects from the port.
Command Purpose
Step 1
dot1x test eapol-capable [interface
interface-id]
Enable the 802.1x readiness check on the switch.
(Optional) For interface-id specify the port on which to check for
IEEE
802.1x readiness.
Note If you omit the optional interface keyword, all interfaces on the
switch are tested.
Step 1
configure terminal (Optional) Enter global configuration mode.
Step 2
dot1x test timeout timeout (Optional) Configure the timeout used to wait for EAPOL response. The
range is from 1 to 65535 seconds. The default is 10 seconds.
Step 3
end (Optional) Return to privileged EXEC mode.
Step 4
show running-config (Optional) Verify your modified timeout values.

Cisco IE 3000 Specifications

General

Operating Temperature	-40 to 75°C (-40 to 167°F)
DRAM	128 MB
Flash Memory	32 MB
Uplink Ports	2 x 10/100/1000Base-T or SFP
MAC Address Table Size	8000
Mounting	DIN rail, Wall