Access Control on the Wired Network
Securing Access Using 802.1x on a wired LAN
71
Best Practice User Guide for the Catalyst 3850 and Catalyst 3650 Switch Series
Step 7
To establish the radius server, configure the RADIUS server with IP address, UDP port for authentication
and accounting server, and server encryption key.
Provision in Monitor Mode
Monitor mode enables IEEE 802.1x authentication without impacting the access of the end devices
(supplicants) to a switch (authenticator). This mode allows you to continuously gather the following
types of data for all the devices connected to your network:
•
List of IEEE 802.1x-capable devices
•
List of devices that are not capable of IEEE 802.1x
•
Devices with good credentials
•
Devices with bad credentials.
•
List of valid MAC addresses (for MAB)
•
List of unknown or invalid MAC addresses (for MAB)
We recommend monitor mode as a first-phase approach to provide secure access with IEEE 802.1x.
Although this mode authenticates the end devices and users (supplicants), traffic is not impacted if
authentication fails.
In monitor mode, IEEE 802.1x and MAB are enabled, but access is open to all users.
Step 8
To allow hosts to gain access to a controlled port, configure multi-authentication host mode and open
authentication.
Step 9
Disable the Port Security feature, because when IEEE 802.1x is enabled, the Port Security feature
becomes redundant and might interfere with the IEEE 802.1x functionality.
Begin in interface configuration mode.
authentication host-mode multi-auth
no switchport port-security violation
no switchport port-security aging type
