Cisco Catalyst 4500 Series, Software Configuration Manual, Page: 1351 / 2086

49-71
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
After you complete these two tasks and receive authorization, ACS sends the configured VLAN group to the switch. The switch
is alerted to the list of VLANs configured under the VLAN group, and the least loaded valid VLAN in the group is assigned
to the port.
Configuring 802.1X with Authentication Failed
By configuring authentication-failed VLAN alignment on any Layer 2 port on the Catalyst 4500 series switch, you can provide
limited network services to clients that fail the authentication process.
Note
You can use authentication-failed VLAN assignment with other security features, such as Dynamic ARP
Inspection (DAI), Dynamic Host Configuration Protocol (DHCP) snooping, and IP Source Guard. Each
of these features can be enabled and disabled independently on the authentication-failed VLAN.
To configure 802.1X with authentication-failed VLAN assignment, perform this task:
Command Purpose
Step 1
Switch# configure terminal
Enters global configuration mode.
Step 2
Switch(config)# interface
interface-id
Enters interface configuration mode and specifies the interface to be
enabled for 802.1X authentication.
Step 3
Switch(config-if)# switchport mode
access
Specifies a nontrunking, nontagged single VLAN Layer 2 interface.
Step 4
Switch(config-if)# authentication
port-control auto
Enables 802.1X authentication on the interface.
Step 5 Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# authentication
event fail action authorize vlan
vlan-id
Cisco IOS Release 12.2(46)SG or earlier
releases
Switch(config-if)# dot1x auth-fail
vlan vlan-id
Enables authentication-failed VLAN on a particular interface.
To disable the authentication-failed VLAN feature on a particular port,
use the
no authentication event fail action authorize vlan interface
configuration command.
Step 6 Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# authentication
event fail retry max-attempts
action [ authorize vlan vlan-id |
next-method ]
Cisco IOS Release 12.2(46)SG or earlier
releases
Switch(config-if)# dot1x auth-fail
max-attempts max-attempts
Configure a maximum number of attempts before the port is moved to
authentication-failed VLAN.
Default is 3 attempts.
Step 7
Switch(config-if)# end
Returns to configuration mode.
Step 8
Switch(config)# end Returns to privileged EXEC mode.
Step 9
Switch# show dot1x interface
interface-id details
(Optional) Verifies your entries.
Step 10
Switch# copy running-config
startup-config
(Optional) Saves your entries in the configuration file.