Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1374 / 2086

49-94
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
•
Although modified trunk parameters are retained, when the trunk link is down or authentication is cleared, the interface is
reconfigured to the following:
– spanning-tree portfast
–
switchport mode access
– switchport access vlan access-vlan-id
Note
access-vlan-id is derived from the switchport trunk native vlan x command entered on the interface. If you have
modified the trunk native VLAN, the configured native VLAN is used as the access-vlan-id when the port returns
to access mode.
• We recommend using 802.1X authentication mode single-host for NEAT configuration on the interface.
•
The cisco-av-pairs must be configured as device-traffic-class=switch on the ACS. This sets the interface as a trunk after
the supplicant is successfully authenticated.
•
You should not modify the trunk mode configurations that are based on device-traffic-class either manually or through
features such as AutoSmart Ports. it is because 802.1X configuration is not supported for trunk ports.
•
To change the host mode and apply a standard port configuration on the authenticator switch port, you can also use
AutoSmart ports user-defined macros rather than the switch VSA. Doing this allows you to remove unsupported
configurations on the authenticator switch port and to change the port mode from access to trunk. For details, see
Chapter 22, “Configuring Cisco IOS Auto Smartport Macros.”
Note
Configuring only the Auto SmartPorts macro does not identify the end host as a supplicant switch. The switch VSA is
required to identify the supplicant switch. However, when Auto Smartports macro is configured, the internal macro that
reconfigures the port from access to trunk is not executed and the Auto Smartports macro should ensure that the port
reconfigures as a trunk port.
Manually Reauthenticating a Client Connected to a Port
You can manually reauthenticate a client connected to a specific port at any time by entering the
dot1x re-authenticate interface privileged EXEC command. If you want to enable or disable periodic reauthentication, see
the “Enabling Periodic Reauthentication” section on page 49-81 .
This example shows how to manually reauthenticate the client connected to Fast Ethernet port 1/1:
Switch# dot1x re-authenticate interface fastethernet1/1
Starting reauthentication on FastEthernet1/1
Initializing the 802.1X Authentication State
The dot1x initialize command causes the authentication process to be restarted regardless of its current state.
This example shows how to restart the authentication process on Fast Ethernet port 1/1:
Switch# dot1x initialize interface fastethernet1/1
This example shows how to restart the authentication process on all ports of the switch:
Switch# dot1x initialize