Cisco IE 4000, Software Configuration Manual

Page: 220 / 1066

216
Configuring IEEE 802.1x Port-Based Authentication
Information About Configuring IEEE 802.1x Port-Based Authentication
When the stop message is not sent successfully, this message appears:
00:09:55: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.20.246.201:1645,1646 is not responding.
Note: You must configure the RADIUS server to perform accounting tasks, such as logging start, stop, and interim-update
messages and time stamps. To turn on these functions, enable logging of “Update/Watchdog packets from this AAA
client” in your RADIUS server Network Configuration tab. Next, enable “CVS RADIUS Accounting” in your RADIUS server
System Configuration tab.
802.1x Authentication Guidelines

When 802.1x authentication is enabled, ports are authenticated before any other Layer 2 features are enabled.

If the VLAN to which an 802.1x-enabled port is assigned changes, this change is transparent and does not affect
the switch. For example, this change occurs if a port is assigned to a RADIUS server-assigned VLAN and is then
assigned to a different VLAN after reauthentication.
If the VLAN to which an 802.1x port is assigned to shut down, disabled, or removed, the port becomes unauthorized.
For example, the port is unauthorized after the access VLAN to which a port is assigned shuts down or is removed.

The 802.1x protocol is supported on Layer 2 static-access ports, and voice VLAN ports, but it is not supported on
these port types:
— Trunk port—If you try to enable 802.1x authentication on a trunk port, an error message appears, and 802.1x
authentication is not enabled. If you try to change the mode of an 802.1x-enabled port to trunk, an error
message appears, and the port mode is not changed.
— Dynamic ports—A port in dynamic mode can negotiate with its neighbor to become a trunk port. If you try to
enable 802.1x authentication on a dynamic port, an error message appears, and 802.1x authentication is not
enabled. If you try to change the mode of an 802.1x-enabled port to dynamic, an error message appears, and
the port mode is not changed.
— Dynamic-access ports—If you try to enable 802.1x authentication on a dynamic-access (VLAN Query Protocol
[VQP]) port, an error message appears, and 802.1x authentication is not enabled. If you try to change an
802.1x-enabled port to dynamic VLAN assignment, an error message appears, and the VLAN configuration is
not changed.
— EtherChannel port—Do not configure a port that is an active or a not-yet-active member of an EtherChannel as
an 802.1x port. If you try to enable 802.1x authentication on an EtherChannel port, an error message appears,
and 802.1x authentication is not enabled.
— Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) destination ports—You can enable 802.1x
authentication on a port that is a SPAN or RSPAN destination port. However, 802.1x authentication is disabled
until the port is removed as a SPAN or RSPAN destination port. You can enable 802.1x authentication on a SPAN
or RSPAN source port.

Before globally enabling 802.1x authentication on a switch by entering the dot1x system-auth-control global
configuration command, remove the EtherChannel configuration from the interfaces on which 802.1x authentication
and EtherChannel are configured.

System messages related to 802.1x authentication can be filtered. See Authentication Manager CLI Commands,
page 195 .
VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible
Authentication Bypass Guidelines

When 802.1x authentication is enabled on a port, you cannot configure a port VLAN that is equal to a voice VLAN.