8-19
Cisco Catalyst Blade Switch 3020 for HP Software Configuration Guide
OL-8915-03
Chapter 8 Configuring IEEE 802.1x Port-Based Authentication
Configuring IEEE 802.1x Authentication
Web authentication requires two Cisco Attribute-Value (AV) pair attributes:
•
The first attribute,
priv-lvl=15
, must always be set to
15
. This sets the privilege level of the user
who is logging into the switch.
•
The second attribute is an access list to be applied for web authenticated hosts. The syntax is similar
to IEEE 802.1X per-user ACLs. However, instead of
ip:inacl
, this attribute must begin with
proxyacl
, and the
source
field in each entry must be
any
. (After authentication, the client IP
address replaces the
any
field when the ACL is applied.)
For example:
proxyacl# 10=permit
ip any 10.0.0.0 255.0.0.0
proxyacl# 20=permit
ip any 11.1.0.0 255.255.0.0
proxyacl# 30=permit
udp any any eq syslog
proxyacl# 40=permit
udp any any eq tftp
Note
The
proxyacl
entry determines the type of allowed network access.
For more information, see the
“Configuring Web Authentication” section on page 8-40
.
Web Authentication with Automatic MAC Check
You can use web authentication with automatic MAC check to authenticate a client that does not support
IEEE 802.1x or web browser functionality. This allows end hosts, such as printers, to automatically
authenticate by using the MAC address without any additional required configuration.
Web authentication with automatic MAC check only works in web authentication standalone mode. You
cannot use this if web authentication is configured as a fallback to IEEE 802.1x authentication.
The MAC address of the device must be configured in the Access Control Server (ACS) for the
automatic MAC check to succeed. The automatic MAC check allows managed devices, such as printers,
to skip web authentication.
Note
The interoperability of web authentication (with automatic MAC check) and IEEE 802.1x MAC
authentication configured on different ports of the same switch is not supported.
Configuring IEEE 802.1x Authentication
These sections contain this configuration information:
•
Default IEEE 802.1x Authentication Configuration, page 8-20
•
IEEE 802.1x Authentication Configuration Guidelines, page 8-21
•
Configuring 802.1x Readiness Check, page 8-23
•
Configuring IEEE 802.1x Authentication, page 8-25
(required)
•
Configuring the Switch-to-RADIUS-Server Communication, page 8-26
(required)
•
Configuring the Host Mode, page 8-28
(optional)
•
Configuring Periodic Re-Authentication, page 8-28
(optional)
•
Manually Re-Authenticating a Client Connected to a Port, page 8-29
(optional)
•
Changing the Quiet Period, page 8-29
(optional)
