9-4
Cisco Catalyst Blade Switch 3130 and 3032 for Dell Software Configuration Guide
OL-13270-06
Chapter 9 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
When the switch receives EAPOL frames and relays them to the authentication server, the Ethernet
header is stripped, and the remaining EAP frame is re-encapsulated in the RADIUS format. The
EAP frames are not modified during encapsulation, and the authentication server must support EAP
within the native frame format. When the switch receives frames from the authentication server, the
server’s frame header is removed, leaving the EAP frame, which is then encapsulated for Ethernet
and sent to the client.
The devices that can act as intermediaries include the Catalyst 3750-E, Catalyst 3750,
Catalyst 3560-E, Catalyst 3560, Catalyst 3550, Catalyst 2970, Catalyst 2960, Catalyst 2955,
Catalyst 2950, Catalyst 2940 switches, or a wireless access point. These devices must be running
software that supports the RADIUS client and IEEE 802.1x authentication.
Authentication Process
When 802.1x port-based authentication is enabled and the client supports 802.1x-compliant client
software, these events occur:
•
If the client identity is valid and the 802.1x authentication succeeds, the switch grants the client
access to the network.
•
If 802.1x authentication times out while waiting for an EAPOL message exchange and MAC
authentication bypass is enabled, the switch can use the client MAC address for authorization. If the
client MAC address is valid and the authorization succeeds, the switch grants the client access to the
network. If the client MAC address is invalid and the authorization fails, the switch assigns the client
to a guest VLAN that provides limited services if a guest VLAN is configured.
•
If the switch gets an invalid identity from an 802.1x-capable client and a restricted VLAN is
specified, the switch can assign the client to a restricted VLAN that provides limited services.
•
If the RADIUS authentication server is unavailable (down) and inaccessible authentication bypass
is enabled, the switch grants the client access to the network by putting the port in the
critical-authentication state in the RADIUS-configured or the user-specified access VLAN.
Note
Inaccessible authentication bypass is also referred to as critical authentication or the AAA fail
policy.
Figure 9-2
shows the authentication process.
If Multi Domain Authentication (MDA) is enabled on a port, this flow can be used with some exceptions
that are applicable to voice authorization. For more information on MDA, see the
“Multidomain
Authentication” section on page 9-30
.
