235
Configuring IEEE 802.1x Port-Based Authentication
Configuration Examples for Configuring IEEE 802.1x Port-Based Authentication
You can verify your settings by entering the show errdisable detect privileged EXEC command.
Configuring the Radius Server Parameters: Example
This example shows how to specify the server with IP address 172.20.39.46 as the RADIUS server, to use port 1612 as
the authorization port, and to set the encryption key to rad123, matching the key on the RADIUS server:
Switch(config)# radius-server host 172.l20.39.46 auth-port 1612 key rad123
Configuring 802.1x Accounting: Example
This example shows how to configure 802.1x accounting. The first command configures the RADIUS server, specifying
1813 as the UDP port for accounting:
Switch(config)# radius-server host 172.120.39.46 auth-port 1812 acct-port 1813 key rad123
Switch(config)# aaa accounting dot1x default start-stop group radius
Switch(config)# aaa accounting system default start-stop group radius
Enabling an 802.1x Guest VLAN: Example
This example shows how to enable VLAN 2 as an 802.1x guest VLAN:
Switch(config)# interface GigabitEthernet1/18
Switch(config-if)# authentication event no-response action authorize vlan 2
This example shows how to set 3 as the quiet time on the switch, to set 15 as the number of seconds that the switch
waits for a response to an EAP-request/identity frame from the client before resending the request, and to enable VLAN
2 as an 802.1x guest VLAN when an 802.1x port is connected to a DHCP client:
Switch(config-if)# authentication timer inactivity 3
Switch(config-if)# authentication timer reauthenticate 15
Switch(config-if)# authentication event no-response action authorize vlan 2
Displaying Authentication Manager Common Session ID: Examples
This example shows how the session ID appears in the output of the show authentication command. The session ID in
this example is 160000050000000B288508E5:
Switch# show authentication sessions
Interface MAC Address Method Domain Status Session ID
Fa4/0/4 0000.0000.0203 mab DATA Authz Success 160000050000000B288508E5
This is an example of how the session ID appears in the syslog output. The session ID in this example is also
160000050000000B288508E5:
1w0d: %AUTHMGR-5-START: Starting 'mab' for client (0000.0000.0203) on Interface Fa4/0/4 AuditSessionID
160000050000000B288508E5
1w0d: %MAB-5-SUCCESS: Authentication successful for client (0000.0000.0203) on Interface Fa4/0/4
AuditSessionID 160000050000000B288508E5
1w0d: %AUTHMGR-7-RESULT: Authentication result 'success' from 'mab' for client (0000.0000.0203) on
Interface Fa4/0/4 AuditSessionID 160000050000000B288508E5
The session ID is used by the NAD, the AAA server, and other report-analyzing applications to identify the client. The ID
appears automatically. No configuration is required.
To Next Page
Loading...
Need help?
General