9-5
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-09
Chapter 9 Configuring 802.1X Port-Based Authentication
Understanding 802.1X Port-Based Authentication
In a point-to-point configuration (see
), only one client can be connected to the
802.1X-enabled switch port. The switch detects the client when the port link state changes to the up state.
If a client leaves or is replaced with another client, the switch changes the port link state to down, and
the port returns to the unauthorized state.
shows 802.1X port-based authentication in a wireless LAN. The 802.1X port is configured
as a multiple-hosts port that becomes authorized as soon as one client is authenticated. When the port is
authorized, all other hosts indirectly attached to the port are granted access to the network. If the port
becomes unauthorized (re-authentication fails or an EAPOL-logoff message is received), the switch
denies access to the network to all of the attached clients. In this topology, the wireless access point is
responsible for authenticating the clients attached to it, and the wireless access point acts as a client to
the switch.
Figure 9-3
Wireless LAN Example
Using 802.1X with Port Security
You can enable an 802.1X port for port security in either single-host or multiple-hosts mode. (You must
also configure port security on the port by using the switchport port-security interface configuration
command.) When you enable port security and 802.1X on a port, 802.1X authenticates the port, and port
security manages network access for all MAC addresses, including that of the client. You can then limit
the number or group of clients that can access the network through an 802.1X port.
These are some examples of the interaction between 802.1X and port security on the switch:
•
When a client is authenticated, and the port security table is not full, the client’s MAC address is
added to the port security list of secure hosts. The port then proceeds to come up normally.
When a client is authenticated and manually configured for port security, it is guaranteed an entry
in the secure host table (unless port security static aging has been enabled).
A security violation occurs if the client is authenticated, but port security table is full. This can
happen if the maximum number of secure hosts has been statically configured, or if the client ages
out of the secure host table. If the client’s address is aged out, its place in the secure host table can
be taken by another host.
The port security violation modes determine the action for security violations. For more
information, see the
“Security Violations” section on page 21-9
.
•
When an 802.1X client logs off, the port transitions back to an unauthenticated state, and all
dynamic entries in the secure host table are cleared, including the entry for the client. Normal
authentication then takes place.
•
If the port is administratively shut down, the port becomes unauthenticated, and all dynamic entries
are removed from the secure host table.
Wireless clients
Access point
Catalyst 2950, 2955,
or 3550 switch
Authentication
server
(RADIUS)
74617