Cisco Catalyst 4500 Series, Руководство по настройке программного обеспечения

Страница: 1304 / 2086

49-24
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
About 802.1X Port-Based Authentication
Limitation in Multi-Authentication Per User VLAN Assignment
In the Multi-Auth Per User VLAN Assignment feature, egress traffic from multiple VLANs are untagged on a port where the
hosts receive traffic that is not meant for them. This can be a problem with broadcast and multicast traffic.
•
IPv4 ARPs: Hosts receive Address Resolution Protocol (ARP) packets from other subnets. This is a problem if two subnets
in different Virtual Routing and Forwarding (VRF) tables with overlapping IP address range are active on the port. The
host ARP cache may get invalid entries.
• IPv6 Control Packets: In IPv6 deployments, Router Advertisements (RA) are processed by hosts that are not supposed to
receive them. When a host from one VLAN receives RA from a different VLAN, the host assign incorrect IPv6 address to
itself. Such a host is unable to get access to the network.
The workaround is to enable the IPv6 first hop security so that the broadcast ICMPv6 packets are converted to unicast and
sent out from multi-auth enabled ports.. The packet is replicated for each client in multi-auth port belonging to the VLAN
and the destination MAC is set to an individual client. Ports having one VLAN, ICMPv6 packets broadcast normally.
•
IP Multicast: Multicast traffic destined to a multicast group gets replicated for different VLANs if the hosts on those
VLANs join the multicast group. When two hosts in different VLANs join a multicast group (on the same multi-auth port),
two copies of each multicast packet are sent out from that port.
Limiting Login for Users
The Limiting Login feature helps Network administrators to limit the login attempt of users to a network. When a user fails to
successfully login to a network within a configurable number of attempts within a configurable time limit, the user can be
blocked. This feature is enabled only for local users and not for remote users. You need to configure the
aaa authentication
rejected command in global configuration mode to enable this feature.
802.1X Supplicant and Authenticator Switches with Network Edge Access
Topology
The Network Edge Access Topology (NEAT) feature extends identity to areas outside the wiring closet (such as conference
rooms).
You can enable any authentication host mode on the authenticator switch interface that connects to a supplicant switch. Once
the supplicant switch authenticates successfully, the port mode changes from access to trunk. To ensure that NEAT works on
all host modes, use the
dot1x supplicant force-multicast global configuration command on the supplicant switch. If the access
VLAN is configured on the authenticator switch, it becomes the native VLAN for the trunk port after successful authentication.
Note MAB is not supported or recommended for use with NEAT. Only use 802.1X to authenticate the
supplicant switch.
Note
The Catalyst 4500 series switch only supports authenticator ports.
Deployment
NEAT is intended for deployment scenarios where a switch acting as 802.1X authenticator to end-hosts (PC or Cisco
IP-phones) is placed in an unsecured location (outside wiring closet).