Cisco Systems, Inc.
www.cisco.com
Access Control on the Wired Network
This workflow describes a phased approach to deploy IEEE 802.1x port-based authentication to provide
secure and identity-based access control at the edge of the switch stack network.
Prerequisites for Access Control on the Wired Network
•
Before globally enabling IEEE 802.1x authentication, remove the EtherChannel configuration from
all of the interfaces.
•
Define the authenticator (switch) to RADIUS server communication.
•
Initiate Extensible Authentication Protocol (EAP) over LAN (EAPoL) messaging to successfully
authenticate the end device (or supplicant).
•
Based on your requirements, choose an appropriate EAP method. For information, see the
Wired
802.1x Deployment Guide
.
•
Automate the certificate enrollment process for supplicants, as described in the
Certificate
Autoenrollment in Windows Server 2003
.
•
Enable machine authentication for end points, such as printers, to ensure that user login is supported.
Restrictions for Access Control on the Wired Network
•
You cannot configure an IEEE 802.1x port that is a member of an EtherChannel.
•
Destination ports configured with Switched Port Analyzer (SPAN) and remote SPAN (RSPAN)
cannot be enabled with IEEE 802.1x authentication.
•
You cannot enable an IEEE 802.1x port on trunk or dynamic ports. Dynamic ports can negotiate with
its neighbors to become a trunk.
•
Do not use port security with IEEE 802.1x. When IEEE 802.1x is enabled, port security then
becomes redundant and might interfere with the IEEE 802.1x functionality.
Identify Configuration Values
