Cisco IE 4000, Software Configuration Manual

Page: 217 / 1066

213
Configuring IEEE 802.1x Port-Based Authentication
Information About Configuring IEEE 802.1x Port-Based Authentication

You can configure a switch to act as a supplicant to another switch by using the 802.1x supplicant feature. This
configuration is helpful in a scenario, where, for example, a switch is outside a wiring closet and is connected to an
upstream switch through a trunk port. A switch configured with the 802.1x switch supplicant feature authenticates
with the upstream switch for secure connectivity.
Once the supplicant switch authenticates successfully the port mode changes from access to trunk.

If the access VLAN is configured on the authenticator switch, it becomes the native VLAN for the trunk port after
successful authentication.
You can enable MDA or multiauth mode on the authenticator switch interface that connects to one more supplicant
switches. Multihost mode is not supported on the authenticator switch interface.
Use the dot1x supplicant force-multicast global configuration command on the supplicant switch for Network Edge
Access Topology (NEAT) to work in all host modes.

Host authorization ensures that only traffic from authorized hosts (connecting to the switch with supplicant) is
allowed on the network. The switches use Client Information Signalling Protocol (CISP) to send the MAC addresses
connecting to the supplicant switch to the authenticator switch, as shown in
Figure 23 on page 213 .

Auto enablement automatically enables trunk configuration on the authenticator switch, allowing user traffic from
multiple VLANs coming from supplicant switches. Configure the cisco-av-pair as
device-traffic-class=switch at the
ACS. (You can configure this under the group or the user settings.)
Figure 23 Authenticator and Supplicant Switch using CISP
802.1x Supplicant and Authenticator Switch Guidelines

You can configure NEAT ports with the same configurations as the other authentication ports. When the supplicant
switch authenticates, the port mode is changed from
access to trunk based on the switch vendor-specific attributes
(VSAs). (device-traffic-class=switch)

The VSA changes the authenticator switch port mode from access to trunk and enables 802.1x trunk encapsulation
and the access VLAN if any would be converted to a native trunk VLAN. VSA does not change any of the port
configurations on the supplicant

To change the host mode and to apply a standard port configuration on the authenticator switch port, you can also
use Auto Smartports user-defined macros, instead of the switch VSA. This allows you to remove unsupported
configurations on the authenticator switch port and to change the port mode from
access to trunk . For information,
see the AutoSmartports Configuration Guide .
1 Workstations (clients) 2 Supplicant switch (outside wiring closet)
3 Authenticator switch 4 Access control server (ACS)
5 Trunk port
20571
8
1
2 3
5
4