Cisco IE 4000, Software Configuration Manual

Page: 222 / 1066

218
Configuring IEEE 802.1x Port-Based Authentication
How to Configure IEEE 802.1x Port-Based Authentication

In multidomain authentication (MDA) mode, one device is allowed for the access VLAN, and one IP phone is allowed
for the voice VLAN.

In multiple-host mode, only one 802.1x supplicant is allowed on the port, but an unlimited number of non-802.1x
hosts are allowed on the access VLAN. An unlimited number of devices are allowed on the voice VLAN.
How to Configure IEEE 802.1x Port-Based Authentication
802.1x Authentication Configuration Process
To configure 802.1x port-based authentication, you must enable authentication, authorization, and accounting (AAA) and
specify the authentication method list. A method list describes the sequence and authentication method to be queried
to authenticate a user.
To allow per-user ACLs or VLAN assignment, you must enable AAA authorization to configure the switch for all
network-related service requests.
This is the 802.1x AAA configuration process:
1. A user connects to a port on the switch.
2. Authentication is performed.
3. The VLAN assignment is enabled, as appropriate, based on the RADIUS server configuration.
4. The switch sends a start message to an accounting server.
5. Reauthentication is performed, as necessary.
6. The switch sends an interim accounting update to the accounting server, that is based on the result of
reauthentication.
7. The user disconnects from the port.
8. The switch sends a stop message to the accounting server.
Beginning in privileged EXEC mode, follow these steps to configure 802.1x port-based authentication:
Command Purpose
1. configure terminal Enters global configuration mode.
2. aaa new-model Enables AAA.
3. aaa authentication dot1x { default }
method1
Creates an 802.1x authentication method list.
To create a default list to use when a named list is not specified in the
authentication command, use the default keyword followed by the
method to use in default situations. The default method list is
automatically applied to all ports.
For method1 , enter the group radius keywords to use the list of all
RADIUS servers for authentication.
Note: Though other keywords are visible in the command-line help string,
only the group radius keywords are supported.
4. dot1x system-auth-control Enables 802.1x authentication globally on the switch.