Cisco Catalyst 2960 Series, Configuration Manual

Page: 1467 / 2288

Purpose Command or Action
• ignore-acct-port — Disable testing on the RADIUS-server accounting
port.
•
ignore-auth-port
— Disable testing on the RADIUS-server
authentication port.
• For
keystring
, specify the authentication and encryption key used
between the switch and the RADIUS daemon running on the
RADIUS server. The key is a text string that must match the
encryption key used on the RADIUS server.
Always configure the key as the last item in the
radius-server host command syntax because leading spaces
are ignored, but spaces within and at the end of the key are
used. If you use spaces in the key, do not enclose the key
in quotation marks unless the quotation marks are part of
the key. This key must match the encryption used on the
RADIUS daemon.
Note
You can also configure the authentication and encryption key by using
the
radius-server key { 0 string | 7string | string } global configuration
command.
(Optional) Configure the parameters for inaccessible authentication bypass: dot1x critical { eapol | recovery delay
milliseconds }
Step 6
•
eapol
—
Specify that the switch sends an EAPOL-Success message
when the switch successfully authenticates the critical port.
Example:
Switch(config)# dot1x critical eapol
•
recovery delaymilliseconds
— Set the recovery delay period during
which the switch waits to re-initialize a critical port when a RADIUS
(config)# dot1x critical recovery delay
2000
server that was unavailable becomes available. The range is from 1
to 10000 milliseconds. The default is 1000 milliseconds (a port can
be re-initialized every second).
Specify the port to be configured, and enter interface configuration mode. interface interface-id
Example:
Switch(config)#
interface
gigabitethernet 1/0/1
Step 7
Use these keywords to move hosts on the port if the RADIUS server is
unreachable: authentication event server dead action
{ authorize | reinitialize } vlan vlan-id ]
Step 8
Example:
Switch(config-if)#
authentication event
•
authorize
—
Move any new hosts trying to authenticate to the
user-specified critical VLAN.
•
reinitialize
—
Move all authorized hosts on the port to the
user-specified critical VLAN.
server dead action
reinitialicze vlan 20
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1385
How to Configure 802.1x Port-Based Authentication