Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1308 / 2086

49-28
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
802.1X Configuration Guidelines
Guidelines for configuring 802.1X authentication include the following:
• The 802.1X protocol is supported only on Layer 2 static access, PVLAN host ports, and Layer 3 routed ports. You cannot
configure 802.1X for any other port modes.
•
If you are planning to use VLAN assignment, be aware that the features use general AAA commands. For information on
how to configure AAA, refer to the
“Enabling 802.1X Authentication” section on page 49-29 . Alternatively, you can refer
to the Cisco IOS security documentation at this location:
Table 49-1 Default 802.1X Configuration
Feature Default Setting
Authentication, authorization, and accounting (AAA) Disabled
RADIUS server
•
IP address
• UDP authentication port
•
Key
•
None specified
• 1645
•
None specified
Per-interface 802.1X protocol enable state Force-authorized
The port transmits and receives normal traffic without
802.1X-based authentication of the client.
Periodic reauthentication Disabled
Time between reauthentication attempts 3600 sec
Quiet period 60 sec
Number of seconds that the switch remains in the quiet state
following a failed authentication exchange with the client.
Retransmission time 30 sec
Number of seconds that the switch should wait for a response to
an EAP request/identity frame from the client before
retransmitting the request.
Maximum retransmission number 2
Number of times that the switch sends an EAP-request/identity
frame before restarting the authentication process.
Multiple host support Disabled
Client timeout period 30 sec
When relaying a request from the authentication server to the
client, the amount of time that the switch waits for a response
before retransmitting the request to the client.
Authentication server timeout period 30 sec
When relaying a response from the client to the authentication
server, the amount of time that the switch waits for a reply before
retransmitting the response to the server. This setting is not
configurable.