Enterasys C5G124-24 - Configuring IEEE 802.1 x

Configuring Authentication
10-14 Configuring User Authentication
Configuring IEEE 802.1x
Configuring IEEE 802.1x on an authenticator switch port consists of:
• Setting the authentication mode globally and per port
• Configuring optional authentication port parameters globally and per port
• Globally enabling 802.1x authentication for the switch
Procedure 10-1 describes how to configure IEEE 802.1x on an authenticator switch port.
Unspecified parameters use their default values.
realm Specifies authentication server
configuration scope.
Both: management-access and
network-access.
VLAN authorization
status
Enables or disables globally and per
port VLAN authorization.
Globally: Disabled.
Per Port: Enabled.
VLAN authorization
egress format
Determines whether dynamic VLAN
tagging will be none, tagged,
untagged, or dynamic for an egress
frame.
Untagged.
Table 10-1 Default Authentication Parameters (continued)
Parameter Description Default Value
Procedure 10-1 IEEE 802.1x Configuration
Step Task Command(s)
1. Set the IEEE 802.1x authentication mode both
globally and per port:
• Auto - The switch will only forward
authenticated frames.
• Forced-auth - 802.1x authentication is
effectively disabled for this port. All received
frames are forwarded.
• Forced-unauth - 802.1x authentication is
effectively disabled on the port. If 802.1x is
the only authentication method on the port, all
frames are dropped.
Note: Before enabling 802.1x authentication on
the switch, you must set the authentication
mode of ports that will not be participating in
802.1x authentication to forced-authorized to
assure that frames will be forwarded on these
ports. Examples of this kind of port are
connections between switches and connections
between a switch and a router.
The setting of dot1x options other than
authcontrolled-portcontrol are optional.
set dot1x auth-config
{[authcontrolled-portcontrol {auto |
forced-auth | forced-unauth}] [maxreq
value] [quietperiod value] [reauthenabled
{false | true}] [reauthperiod value]
[servertimeout timeout] [supptimeout
timeout] [txperiod value]} [port-string]