Cisco 3750G - Catalyst Integrated Wireless LAN Controller, Руководство по настройке

Страница: 263 / 1204

10-9
Catalyst 3750 Switch Software Configuration Guide
OL-8550-02
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
unauthorized (re-authentication fails or an EAPOL-logoff message is received), the switch denies
network access to all of the attached clients. In this topology, the wireless access point is responsible for
authenticating the clients attached to it, and it also acts as a client to the switch.
With the multiple-hosts mode enabled, you can use IEEE 802.1x authentication to authenticate the port
and port security to manage network access for all MAC addresses, including that of the client.
Figure 10-5 Multiple Host Mode Example
Cisco IOS Release 12.2(35)SE and later support Multi-Domain Authentication (MDA), which allows
both a data device and a voice device, such as an IP Phone (Cisco or non-Cisco), to connect to the same
switch port. For more information, see the
“Using Multidomain Authentication” section on page 10-20 .
IEEE 802.1x Accounting
The IEEE 802.1x standard defines how users are authorized and authenticated for network access but
does not keep track of network usage. IEEE 802.1x accounting is disabled by default. You can enable
IEEE 802.1x accounting to monitor this activity on IEEE 802.1x-enabled ports:
•
User successfully authenticates.
•
User logs off.
•
Link-down occurs.
•
Re-authentication successfully occurs.
•
Re-authentication fails.
The switch does not log IEEE 802.1x accounting information. Instead, it sends this information to the
RADIUS server, which must be configured to log accounting messages.
IEEE 802.1x Accounting Attribute-Value Pairs
The information sent to the RADIUS server is represented in the form of Attribute-Value (AV) pairs.
These AV pairs provide data for different applications. (For example, a billing application might require
information that is in the Acct-Input-Octets or the Acct-Output-Octets attributes of a RADIUS packet.)
AV pairs are automatically sent by a switch that is configured for IEEE 802.1x accounting. Three types
of RADIUS accounting packets are sent by a switch:
•
START–sent when a new user session starts
•
INTERIM–sent during an existing session for updates
•
STOP–sent when a session terminates
101227
Wireless clients
Access point
Authentication
server
(RADIUS)