10-31
Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-08
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
•
When a
data
or a
voice
device is detected on a port, its MAC address is blocked until authorization
succeeds. If the authorization fails, the MAC address remains blocked for 5 minutes.
•
If more than five devices are detected on the
data
VLAN or more than one voice device is detected
on the
voice
VLAN while a port is unauthorized, the port is error disabled.
•
When a port host mode is changed from single- or multihost to multidomain mode, an authorized
data device remains authorized on the port. However, a Cisco IP phone that has been allowed on the
port voice VLAN is automatically removed and must be reauthenticated on that port.
•
Active fallback mechanisms such as guest VLAN and restricted VLAN remain configured after a
port changes from single- or multihost mode to multidomain mode.
•
Switching a port host mode from multidomain to single- or multihost mode removes all authorized
devices from the port.
•
If a data domain is authorized first and placed in the guest VLAN, non-IEEE 802.1x-capable voice
devices need to tag their packets on the voice VLAN to trigger authentication.
•
We do not recommend per-user ACLs with an MDA-enabled port. An authorized device with a
per-user ACL policy might impact traffic on both the voice and data VLANs of the port. If used,
only one device on the port should enforce per-user ACLs.
802.1x Supplicant and Authenticator Switches with Network Edge Access
Topology (NEAT)
The Network Edge Access Topology (NEAT) feature extends identity to areas outside the wiring closet
(such as conference rooms). This allows any type of device to authenticate on the port.
•
802.1x switch supplicant: You can configure a switch to act as a supplicant to another switch by
using the 802.1x supplicant feature. This configuration is helpful in a scenario, where, for example,
a switch is outside a wiring closet and is connected to an upstream switch through a trunk port. A
switch configured with the 802.1x switch supplicant feature authenticates with the upstream switch
for secure connectivity. Once the supplicant switch authenticates successfully the port mode
changes from access to trunk.
•
If the access VLAN is configured on the authenticator switch, it becomes the native VLAN for the
trunk port after successful authentication.
You can enable MDA or multiauth mode on the authenticator switch interface that connects to one more
supplicant switches. Multihost mode is not supported on the authenticator switch interface.
Use the
dot1x supplicant force-multicast
global configuration command on the supplicant switch for
Network Edge Access Topology (NEAT) to work in all host modes.
•
Host Authorization: Ensures that only traffic from authorized hosts (connecting to the switch with
supplicant) is allowed on the network. The switches use Client Information Signalling Protocol
(CISP) to send the MAC addresses connecting to the supplicant switch to the authenticator switch,
as shown in
.
•
Auto enablement: Automatically enables trunk configuration on the authenticator switch, allowing
user traffic from multiple VLANs coming from supplicant switches. Configure the cisco-av-pair as
device-traffic-class=switch
at the ACS. (You can configure this under the
group
or the
user
settings.)
Содержание Catalyst 3750-E Series
Страница 48: ...Contents xlviii Catalyst 3750 E and 3560 E Switch Software Configuration Guide OL 9775 08 ...
Страница 52: ...lii Catalyst 3750 E and 3560 E Switch Software Configuration Guide OL 9775 08 Preface ...
Страница 1414: ...Index IN 58 Catalyst 3750 E and 3560 E Switch Software Configuration Guide OL 9775 08 ...
