Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1287 / 2086

49-7
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
About 802.1X Port-Based Authentication
Single-Host Mode
You can configure an 802.1X port for single-host or multiple-hosts mode. In single-host mode (see Figure 49-1 on page 49-3 ),
only one client can be connected to the 802.1X-enabled switch port. The switch detects the client by sending an EAPOL frame
when the port link state changes to the up state. If a client leaves or is replaced with another client, the switch changes the port
link state to down, and the port returns to the unauthorized state.
Multiple-Hosts Mode
In multiple-hosts mode, you can attach multiple hosts to a single 802.1X-enabled port. Figure 49-4 on page 49-7 shows 802.1X
port-based authentication in a wireless LAN. In this mode, only one of the attached clients must be authorized for all clients
to be granted network access. If the port becomes unauthorized (reauthentication fails or an EAPOL-logoff message is
received), the switch denies network access to all of the attached clients. In this topology, the wireless access point is
responsible for authenticating the clients attached to it, and it also acts as a client to the switch.
With multiple-hosts mode enabled, you can use 802.1X authentication to authenticate the port and port security to manage
network access for all MAC addresses, including that of the client.
Note
Wired guest access does not work on Supervisor Engine 8-E, in multiple-host mode or in
multi-authentication mode.
Figure 49-4 Multiple Host Mode Example
Multidomain Authentication Mode
Beginning with Cisco IOS Release 12.2(37)SG, Catalyst 4500 series switches support Multidomain Authentication (MDA),
which allows an IP phone (Cisco or third-party) and a single host behind the IP phone to authenticate independently, using
802.1X, MAC authentication bypass (MAB) or (for the host only) web-based authentication. In this application,
multidomain
refers to two domains — data and voice — and only two MAC addresses are allowed per-port. A switch can place the host in
the data VLAN and the IP phone in the voice VLAN, even though they appear on the same switch port. The data VLAN and
the voice VLAN can be specified in the CLI configuration. The devices are identified as either data or voice depending on the
vendor-specific-attributes (VSAs) received from the authentication, authorization, and accounting (AAA) server. The data and
voice VLANs can also be obtained from the VSAs received from the (AAA) server during authentication.
101227
Wireless clients
Access point
Authentication
server
(RADIUS)