217
Configuring IEEE 802.1x Port-Based Authentication
Information About Configuring IEEE 802.1x Port-Based Authentication
The 802.1x authentication with VLAN assignment feature is not supported on trunk ports, dynamic ports, or with
dynamic-access port assignment through a VMPS.
You can configure 802.1x authentication on a private-VLAN port, but do not configure 802.1x authentication with
port security, a voice VLAN, a guest VLAN, a restricted VLAN, or a per-user ACL on private-VLAN ports.
You can configure any VLAN except an RSPAN VLAN, private VLAN, or a voice VLAN as an 802.1x guest VLAN. The
guest VLAN feature is not supported on internal VLANs (routed ports) or trunk ports; it is supported only on access
ports.
After you configure a guest VLAN for an 802.1x port to which a DHCP client is connected, you might need to get a
host IP address from a DHCP server. You can change the settings for restarting the 802.1x authentication process
on the switch before the DHCP process on the client times out and tries to get a host IP address from the DHCP
server. Decrease the settings for the 802.1x authentication process (authentication timer inactivity and
authentication timer reauthentication interface configuration commands). The amount to decrease the settings
depends on the connected 802.1x client type.
When configuring the inaccessible authentication bypass feature, follow these guidelines:
— The feature is supported on 802.1x port in single-host mode and multihosts mode.
— If the client is running Windows XP and the port to which the client is connected is in the critical-authentication
state, Windows XP might report that the interface is not authenticated.
— If the Windows XP client is configured for DHCP and has an IP address from the DHCP server, receiving an
EAP-Success message on a critical port might not reinitiate the DHCP configuration process.
— You can configure the inaccessible authentication bypass feature and the restricted VLAN on an 802.1x port. If
the switch tries to reauthenticate a critical port in a restricted VLAN and all the RADIUS servers are unavailable,
switch changes the port state to the critical authentication state and remains in the restricted VLAN.
You can configure any VLAN except an RSPAN VLAN or a voice VLAN as an 802.1x restricted VLAN. The restricted
VLAN feature is not supported on internal VLANs (routed ports) or trunk ports; it is supported only on access ports.
MAC Authentication Bypass Guidelines
Unless otherwise stated, the MAC authentication bypass guidelines are the same as the 802.1x authentication
guidelines. For more information, see 802.1x Authentication Guidelines, page 216.
If you disable MAC authentication bypass from a port after the port has been authorized with its MAC address, the
port state is not affected.
If the port is in the unauthorized state and the client MAC address is not the authentication-server database, the port
remains in the unauthorized state. However, if the client MAC address is added to the database, the switch can use
MAC authentication bypass to reauthorize the port.
If the port is in the authorized state, the port remains in this state until reauthorization occurs.
You can configure a timeout period for hosts that are connected by MAC authentication bypass but are inactive. The
range is 1to 65535 seconds.
Maximum Number of Allowed Devices Per Port Guidelines
This is the maximum number of devices allowed on an 802.1x-enabled port:
In single-host mode, only one device is allowed on the access VLAN. If the port is also configured with a voice VLAN,
an unlimited number of Cisco IP phones can send and receive traffic through the voice VLAN.
To Next Page
Loading...
Need help?
General
