8-41
Cisco Catalyst Blade Switch 3020 for HP Software Configuration Guide
OL-8915-03
Chapter 8 Configuring IEEE 802.1x Port-Based Authentication
Configuring IEEE 802.1x Authentication
This example shows how to enable AAA, use RADIUS authentication and enable device tracking:
Switch(config)
configure terminal
Switch(config)#
aaa new-model
Switch(config)#
aaa authentication login default group radius
Switch(config)#
aaa authorization auth-proxy default group radius
Switch(config)#
radius-server host 1.1.1.2 key key1
Switch(config)#
radius-server attribute 8 include-in-access-req
Switch(config)#
radius-server vsa send authentication
Switch(config)#
ip device tracking
Switch(config)
end
Beginning in privileged EXEC mode, follow these steps to configure a port to use web authentication:
Step 5
radius-server host key
radius-key
Specify the authentication and encryption key for RADIUS
communication between the switch and the RADIUS daemon.
Step 6
radius-server attribute 8
include-in-access-req
Configure the switch to send the Framed-IP-Address RADIUS
attribute (Attribute[8]) in access-request or accounting-request
packets.
Step 7
radius-server vsa send authentication
Configure the network access server to recognize and use
vendor-specific attributes (VSAs).
Step 8
ip device tracking
Enable the IP device tracking table.
To disable the IP device tracking table, use the
no ip device tracking
global configuration commands.
Step 9
end
Return to privileged EXEC mode.
Command
Purpose
Command
Purpose
Step 1
configure terminal
Enter global configuration mode.
Step 2
ip admission name
rule
proxy http
Define a web authentication rule.
Note
The same rule cannot be used for both web authentication and
NAC Layer 2 IP validation. For more information, see the
Network Admission Control Software Configuration Guide
on
Cisco.com.
Step 3
interface
interface-id
Specify the port to be configured, and enter interface configuration
mode.
Step 4
switchport mode access
Set the port to access mode.
Step 5
ip access-group
access-list
in
Specify the default access control list to be applied to network traffic
before web authentication.
Step 6
ip admission
rule
Apply an IP admission rule to the interface.
Step 7
end
Return to privileged EXEC mode.
Step 8
show running-config interface
interface-id
Verify your configuration.
Step 9
copy running-config startup-config
(Optional) Save your entries in the configuration file.
