Cisco Catalyst 2960 Series, Configuration Manual

Page: 1417 / 2288

◦ If a voice device is authorized and is using a downloaded voice VLAN, the removal of the voice
VLAN configuration, or modifying the configuration value to dot1p or untagged results in voice
device un-authorization and the disablement of multi-domain host mode.
When the port is in the force authorized, force unauthorized, unauthorized, or shutdown state, it is put into
the configured access VLAN.
If an 802.1x port is authenticated and put in the RADIUS server-assigned VLAN, any change to the port
access VLAN configuration does not take effect. In the case of a multidomain host, the same applies to voice
devices when the port is fully authorized with these exceptions:
• If the VLAN configuration change of one device results in matching the other device configured or
assigned VLAN, authorization of all devices on the port is terminated and multidomain host mode is
disabled until a valid configuration is restored where data and voice device configured VLANs no longer
match.
• If a voice device is authorized and is using a downloaded voice VLAN, the removal of the voice VLAN
configuration, or modifying the configuration value to
dot1p or untagged results in voice device
un-authorization and the disablement of multi-domain host mode.
When the port is in the force authorized, force unauthorized, unauthorized, or shutdown state, it is put into
the configured access VLAN.
The 802.1x authentication with VLAN assignment feature is not supported on trunk ports, dynamic ports, or
with dynamic-access port assignment through a VLAN Membership Policy Server (VMPS).
To configure VLAN assignment you need to perform these tasks:
• Enable AAA authorization by using the network keyword to allow interface configuration from the
RADIUS server.
• Enable 802.1x authentication. (The VLAN assignment feature is automatically enabled when you
configure 802.1x authentication on an access port).
• Assign vendor-specific tunnel attributes in the RADIUS server. The RADIUS server must return these
attributes to the switch:
◦ [64] Tunnel-Type = VLAN
◦ [65] Tunnel-Medium-Type = 802
◦ [81] Tunnel-Private-Group-ID = VLAN name or VLAN ID
◦ [83] Tunnel-Preference
Attribute [64] must contain the value VLAN (type 13). Attribute [65] must contain the value 802 (type
6). Attribute [81] specifies the VLAN name or VLAN ID assigned to the IEEE 802.1x-authenticated user.
802.1x Authentication with Per-User ACLs
You can enable per-user access control lists (ACLs) to provide different levels of network access and service
to an 802.1x-authenticated user. When the RADIUS server authenticates a user connected to an 802.1x port,
it retrieves the ACL attributes based on the user identity and sends them to the switch. The switch applies the
attributes to the 802.1x port for the duration of the user session. The switch removes the per-user ACL
configuration when the session is over, if authentication fails, or if a link-down condition occurs. The switch
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1335
Information About 802.1x Port-Based Authentication