Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1364 / 2086

49-84
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
This example shows how to enable 802.1X on Fast Ethernet interface 5/9 and to allow multiple hosts:
Cisco IOS Release 12.2(50)SG and later
Switch# configure terminal
Switch(config)# interface fastethernet5/9
Switch(config-if)# switchport mode access
Switch(config-if)# dot1x pae authenticator
Switch(config-if)# authentication host-mode multi-host
Switch(config-if)# authentication port-control auto
Switch(config-if)# end
Switch#
Cisco IOS Release 12.2(46)SG or earlier
Switch#
configure terminal
Switch(config)# interface fastethernet5/9
Switch(config-if)# switchport mode access
Switch(config-if)#
dot1x pae authenticator
Switch(config-if)# dot1x host-mode multi-host
Switch(config-if)# dot1x port-control auto
Switch(config-if)#
end
Switch#
Changing the Quiet Period
When the switch cannot authenticate the client, the switch remains idle for a set period of time, and then tries again. The idle
time is determined by the
quiet-period value. A failed authentication of the client might occur because the client provided an
invalid password. You can provide a faster response time to the user by entering a number smaller than the default.
To change the quiet period, perform this task:
Command Purpose
Step 1
Switch# configure terminal
Enters global configuration mode.
Step 2
Switch(config)# interface
interface-id
Enters interface configuration mode and specifies the interface to be
enabled for timeout
quiet-period .
Step 3
Switch(config-if)# switchport mode
access
Specifies a nontrunking, nontagged single VLAN Layer 2 interface.
Step 4
Switch(config-if)# dot1x pae
authenticator
Enables 802.1X authentication on the port with default parameters.
Refer to the “Default 802.1X Configuration” section on page 49-27 .
Step 5
Switch(config-if)# dot1x timeout
quiet-period seconds
Sets the number of seconds that the switch remains in the quiet-period
following a failed authentication exchange with the client.
To return to the default quiet-period, use the
no dot1x timeout quiet-period configuration command.
The range is 0 to 65,535 seconds; the default is 60.
Step 6
Switch(config-if)# authentication
port-control auto
Enables 802.1X authentication on the interface.
Step 7
Switch(config-if)# end
Returns to privileged EXEC mode.
Step 8
Switch# show dot1x all
Verifies your entries.
Step 9
Switch# copy running-config
startup-config
(Optional) Saves your entries in the configuration file.