Cisco IE 4000, Software Configuration Manual

Page: 228 / 1066

224
Configuring IEEE 802.1x Port-Based Authentication
How to Configure IEEE 802.1x Port-Based Authentication
Configuring Optional 802.1x Authentication Features
Command Purpose
1. dot1x reauthenticate interface
interface-id
(Optional) Manually initiates a reauthentication of the specified IEEE
802.1x-enabled port.
2. authentication mac-move permit (Optional) Enables MAC move on the switch.
3. authentication violation { protect |
replace | restrict | shutdown }
(Optional) replace —Enables MAC replace on the interface. The port
removes the current session and initiates authentication with the new
host.
The other keywords have these effects:

protect —Drops port packets with unexpected MAC addresses
without generating a system message.

restrict — Drops violating packets by the CPU and a system message
is generated.

shutdown — Error-disables the port when it receives an unexpected
MAC address.
1. configure terminal Enters global configuration mode.
2. mab request format attribute 32 vlan
access-vlan (Optional) Enables VLAN ID-based MAC authentication.
3. interface interface-id (Optional) Specifies the port to be configured, and enters interface
configuration mode.
4. authentication timer inactivity seconds (Optional) Sets the number of seconds that the switch remains in the quiet
state after a failed authentication exchange with the client.
The range is 1 to 65535 seconds; the default is 60.
5. authentication timer reauthenticate
seconds
(Optional) Sets the number of seconds that the switch waits for a
response to an EAP-request/identity frame from the client before
resending the request.
The range is 1 to 65535 seconds; the default is 5.
Note: You should change the default value of this command only to
adjust for unusual circumstances such as unreliable links or specific
behavioral problems with certain clients and authentication servers.
6. dot1x max-reauth-req count (Optional) Sets the number of times that the switch sends an
EAP-request/identity frame to the client before restarting the
authentication process. The range is 1 to 10; the default is 2.
Note: You should change the default value of this command only to
adjust for unusual circumstances such as unreliable links or specific
behavioral problems with certain clients and authentication servers.
7. dot1x max-req count (Optional) Sets the number of times that the switch restarts the
authentication process before the port changes to the unauthorized state.
The range is 0 to 10; the default is 2.