Cisco Catalyst 4500 Series, Руководство по настройке программного обеспечения, Страница: 1347 / 2086

49-67
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
Note Unidirectional controlled port only works when Spanning Tree PortFast is enabled on the port.
Unidirectional controlled port and Spanning Tree PortFast should be configured on a switch port that
connects to a host. If two such ports are connected together with an Ethernet cable, high CPU utilization
may result because host learning will be flapping between the two ports.
This example shows how to enable unidirectional port control:
Cisco IOS Release 12.2(50)SG and later
Switch#
configure terminal
Switch(config)# interface gigabitethernet3/3
Switch(config-if)# switchport mode access
Switch(config-if)#
dot1x pae authenticator
Switch(config-if)# authentication port-control auto
Switch(config-if)# authentication control-direction in
Switch(config-if)#
end
Switch# show dot1x int g3/3
Dot1x Info for GigabitEthernet3/3
-----------------------------------
PAE = AUTHENTICATOR
PortControl = AUTO
ControlDirection = In
HostMode = SINGLE_HOST
ReAuthentication = Disabled
QuietPeriod = 60
ServerTimeout = 30
SuppTimeout = 30
ReAuthPeriod = 3600 (Locally configured)
ReAuthMax = 2
MaxReq = 2
TxPeriod = 30
Step 3
Switch(config-if)# switchport mode
access
or
Switch(config-if)# switchport mode
private-vlan host
Specifies a nontrunking, nontagged single VLAN Layer 2 interface.
Specifies that the ports with a valid PVLAN trunk association become active
host PVLAN trunk ports.
Step 4
Switch(config-if)# dot1x pae
authenticator
Enables 802.1X authentication on the port with default parameters.
Refer to the “Default 802.1X Configuration” section on page 49-27 .
Step 5
Switch(config-if)# authentication
port-control auto
Enables 802.1X authentication on the interface.
Step 6 Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# authentication
control-direction { in | both }
Cisco IOS Release 12.2(46)SG or earlier
releases
Switch(config-if)# dot1x
control-direction {in | both}
Enables unidirectional port control on each port.
Step 7
Switch(config)# end
Returns to privileged EXEC mode.
Step 8
Switch#
show dot1x interface
interface-id details
(Optional) Verifies your entries.
Step 9
Switch# copy running-config
startup-config
(Optional) Saves your entries in the configuration file.
Command Purpose