Cisco Catalyst 3560-X Series, Software Configuration Manual

Page: 335 / 1538

1-47
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-25303-03
Chapter 1 Configuring IEEE 802.1x Port-Based Authentication
Configuring 802.1x Authentication
You also need to configure some settings on the RADIUS server. These settings include the IP address
of the switch and the key string to be shared by both the server and the switch. For more information,
see the RADIUS server documentation.
Configuring the Host Mode
Beginning in privileged EXEC mode, follow these steps to allow multiple hosts (clients) on an
IEEE 802.1x-authorized port that has the
dot1x port-control interface configuration command set to
auto . Use the multi-domain keyword to configure and enable multidomain authentication (MDA),
which allows both a host and a voice device, such as an IP phone (Cisco or non-Cisco), on the same
switch port. This procedure is optional.
To disable multiple hosts on the port, use the no authentication host-mode or the
no authentication host-mode multi-host interface configuration command.
This example shows how to enable 802.1x authentication and to allow multiple hosts:
Switch(config)# interface gigabitethernet2/0/1
Switch(config-if)# authentication port-control auto
Switch(config-if)# authentication host-mode multi-host
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2
interface interface-id Specify the port to which multiple hosts are indirectly attached, and enter
interface configuration mode.
Step 3 authentication host-mode [ multi-auth |
multi-domain | multi-host |
single-host ]
Allow multiple hosts (clients) on an 802.1x-authorized port.
The keywords have these meanings:
•
multi-auth –Allow one client on the voice VLAN and multiple
authenticated clients on the data VLAN.
Note The multi-auth keyword is only available with the
authentication host-mode command.
•
multi-host –Allow multiple hosts on an 802.1x-authorized port after
a single host has been authenticated.
•
multi-domain –Allow both a host and a voice device, such as an IP
phone (Cisco or non-Cisco), to be authenticated on an
IEEE 802.1x-authorized port.
Note You must configure the voice VLAN for the IP phone when the
host mode is set to
multi-domain . For more information, see
Chapter 1, “Configuring Voice VLAN.”
Make sure that the authentication port-control interface configuration
command set is set to auto for the specified interface.
Step 4
end Return to privileged EXEC mode.
Step 5 show authentication interface
interface-id
Verify your entries.
Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.