12-30
Cisco IE 3000 Switch Software Configuration Guide
OL-13018-03
Chapter 12 Configuring IEEE 802.1x Port-Based Authentication
Configuring 802.1x Authentication
•
After you configure a guest VLAN for an 802.1x port to which a DHCP client is connected, you
might need to get a host IP address from a DHCP server. You can change the settings for restarting
the 802.1x authentication process on the switch before the DHCP process on the client times out and
tries to get a host IP address from the DHCP server. Decrease the settings for the 802.1x
authentication process (
authentication timer inactivity
or
dot1x timeout quiet-period)
and
authentication timer reauthentication
or
dot1x timeout tx-period)
interface configuration
commands). The amount to decrease the settings depends on the connected 802.1x client type.
•
When configuring the inaccessible authentication bypass feature, follow these guidelines:
–
The feature is supported on 802.1x port in single-host mode and multihosts mode.
–
If the client is running Windows XP and the port to which the client is connected is in the
critical-authentication state, Windows XP might report that the interface is not authenticated.
–
If the Windows XP client is configured for DHCP and has an IP address from the DHCP server,
receiving an EAP-Success message on a critical port might not re-initiate the DHCP
configuration process.
–
You can configure the inaccessible authentication bypass feature and the restricted VLAN on
an 802.1x port. If the switch tries to re-authenticate a critical port in a restricted VLAN and all
the RADIUS servers are unavailable, switch changes the port state to the critical authentication
state and remains in the restricted VLAN.
–
You can configure the inaccessible bypass feature and port security on the same switch port.
•
You can configure any VLAN except an RSPAN VLAN or a voice VLAN as an 802.1x restricted
VLAN. The restricted VLAN feature is not supported on trunk ports; it is supported only on access
ports.
MAC Authentication Bypass
These are the MAC authentication bypass configuration guidelines:
•
Unless otherwise stated, the MAC authentication bypass guidelines are the same as the 802.1x
authentication guidelines. For more information, see the
“802.1x Authentication” section on
page 12-29
.
•
If you disable MAC authentication bypass from a port after the port has been authorized with its
MAC address, the port state is not affected.
•
If the port is in the unauthorized state and the client MAC address is not the authentication-server
database, the port remains in the unauthorized state. However, if the client MAC address is added to
the database, the switch can use MAC authentication bypass to re-authorize the port.
•
If the port is in the authorized state, the port remains in this state until re-authorization occurs.
•
You can configure a timeout period for hosts that are connected by MAC authentication bypass but
are inactive. The range is 1to 65535 seconds. You must enable port security before configuring a
time out value. For more information, see the
“Configuring Port Security” section on page 26-8
.
Maximum Number of Allowed Devices Per Port
This is the maximum number of devices allowed on an 802.1x-enabled port:
•
In single-host mode, only one device is allowed on the access VLAN. If the port is also configured with
a voice VLAN, an unlimited number of Cisco IP phones can send and receive traffic through the voice
VLAN.
