Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1341 / 2086

49-61
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
Note
Removing a 802.1X MAB configuration from a port does not impact the authorized or authenticated
state of the port. If the port is in an unauthenticated state, it remains in that state. If the port is in an
authenticated state because of MAB, the switch reverts to the 802.1X Authenticator. If the port was
already authorized with a MAC address and the MAB configuration was removed, the port remains in
an authorized state until reauthentication occurs. At that time, if an 802.1X supplicant is detected on the
wire, the MAC address is removed.
This example shows how to enable MAB on Gigabit Ethernet interface 3/3 and to verify the configuration:
Cisco IOS Release 12.2(50)SG and later
Switch# configure terminal
Switch(config)# interface gigabitethernet3/3
Switch(config-if)# switchport mode access
Switch(config-if)# dot1x pae authenticator
Switch(config-if)# authentication port-control auto
Switch(config-if)# mab
Switch(config-if)# end
Switch# show mab int g3/3 details
MAB details for GigabitEthernet3/3
-------------------------------------
Mac-Auth-Bypass = Enabled
MAB Client List
---------------
Client MAC = 0001.0001.0001
Session ID = C0A8016F0000002304175914
MAB SM state = TERMINATE
Auth Status = AUTHORIZED
Step 4
Switch(config-if)# dot1x pae
authenticator
Enables 802.1X authentication on the port with default parameters.
Refer to the “Default 802.1X Configuration” section on page 49-27 .
Step 5 Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# authentication
port-control auto
Cisco IOS Release 12.2(46)SG or earlier
releases
Switch(config-if)# dot1x
port-control auto
Enables 802.1X authentication on the interface.
Step 6
Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# mab [eap]
Cisco IOS Release 12.2(46)SG or earlier
releases
Switch(config-if)# dot1x
mac-auth-bypass [eap]
Enables MAB on a switch.
The eap option specifies that a complete EAP conversation should be
used, as opposed to standard RADIUS Access-Request, Access-Accept
conversation. By default, the
eap option is not enabled for MAB.
Step 7
Switch(config)#
end
Returns to privileged EXEC mode.
Step 8
Switch# show mab interface
interface-id details
(Optional) Verifies your entries.
Step 9
Switch# copy running-config
startup-config
(Optional) Saves your entries in the configuration file.
Command Purpose