46-8
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
OL-4266-08
Chapter 46 Configuring IEEE 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
When you enable 802.1X port-based authentication, note the following information:
•
To create a default list that is used when a named list is
not
specified in the
authentication
command, use the
default
keyword followed by the methods that are to be used in default situations.
The default method list is automatically applied to all interfaces.
•
Enter at least one of these keywords:
–
group radius
—Use the list of all RADIUS servers for authentication.
–
none
—Use no authentication. The client is automatically authenticated by the router without
using the information supplied by the client.
This example shows how to enable AAA and 802.1X on Fast Ethernet port 5/1:
Router#
configure terminal
Router(config)#
aaa new-model
Router(config)#
aaa authentication dot1x default group radius
Router(config)#
dot1x system-auth-control
Router(config)#
interface fastethernet 5/1
Router(config-if)#
dot1x port-control auto
Router(config-if)#
end
This example shows how to verify the configuration:
Router#
show dot1x all
Dot1x Info for interface FastEthernet5/1
----------------------------------------------------
Command
Purpose
Step 1
Router(config)#
aaa new-model
Enables AAA.
Router(config)#
no aaa new-model
Disables AAA.
Step 2
Router(config)#
aaa authentication dot1x
{
default
}
method1
[
method2
...
]
Creates an 802.1X port-based authentication method list.
Router(config)#
no aaa authentication dot1x
{
default
|
list_name
}
Clears the configured method list.
Step 3
Router(config)#
dot1x system-auth-control
Globally enables 802.1X port-based authentication.
Router(config)#
no dot1x system-auth-control
Globally disables 802.1X port-based authentication.
Step 4
Router(config)#
interface
type
1
slot/port
1.
type
=
ethernet
,
fastethernet
,
gigabitethernet
, or
tengigabitethernet
Enters interface configuration mode and specifies the
interface to be enabled for 802.1X port-based
authentication.
Step 5
Router(config-if)#
dot1x port-control auto
Enables 802.1X port-based authentication on the
interface.
Router(config-if)#
no dot1x port-control auto
Disables 802.1X port-based authentication on the
interface.
Step 6
Router(config)#
end
Returns to privileged EXEC mode.
Step 7
Router#
show dot1x all
Verifies your entries.
Check the Status column in the 802.1X Port Summary
section of the display. An
enabled
status means the
port-control value is set either to
auto
or to
force-unauthorized
.
