Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1369 / 2086

49-89
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
When CISP is enabled on a trunk port, the following features are inert. When CISP is neither running nor configured, these
features operate as expected:
• VLAN assignment
•
Guest, Authentication Failure, voice, and critical VLANs
• Critical authentication
•
Wake-on-LAN
• Web authentication
•
Port security
• Violation modes (restrict, shut down, and shut down VLAN)
The following example shows how to enable CISP on a port. You must configure the following procedure in the Cisco ACS
server. Configuring a user with Cisco AV Pair value, allows SSW to authenticate itself with the ASW. Because the user is
attached with the AV pair value, upon successful authentication on ASW, the macro is executed on the interface on which SSW
is authenticated:
Switch#
configure terminal
Switch(config)# cisp enable
Switch(config)# interface GigabitEthernet5/23
Switch(config-if)#
switchport mode access
Switch(config-if)# spanning-tree portfast
Switch(config-if)# dot1x pae authenticator
Switch(config-if)#
authentication port-control auto
Cisco AV Pair Configuration
Next, you need to configure a Cisco AV pair value.
Log into ACS, and Select/Create a User. Go to User Setup and scroll down to the [009\001] cisco-av-pair Tab. Enter
device-traffic-class=switch ( Figure 49-17 ).