Cisco Catalyst 4500 Series, Руководство по настройке программного обеспечения

Страница: 1288 / 2086

49-8
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
About 802.1X Port-Based Authentication
Figure 49-5 Multidomain Authentication Mode Example
Figure 49-5 shows a typical MDA application with a single host behind an IP phone connected to the 802.1X-enabled port.
Because the client is not directly connected to the switch, the switch cannot detect a loss of port link if the client is
disconnected. To prevent another device from using the established authentication of the disconnected client later, Cisco IP
phones send a Cisco Discovery Protocol (CDP) host presence type length value (TLV) to notify the switch of changes in the
attached client’s port link state.
For details on how to configure MDA, see the “Using Multiple Domain Authentication and Multiple Authentication” section
on page 49-22 .
Multiauthentication Mode
Available starting in Cisco IOS Release 12.2(50)SG, multiauthentication mode allows one client on the voice VLAN and
multiple authenticated clients on the data VLAN. When a hub or access point is connected to an 802.1X port,
multiauthentication mode provides enhanced security over multiple-hosts mode by requiring authentication of each connected
client. For non-802.1X devices, you can use MAB or web-based authentication as the fallback method for individual host
authentications, allowing you to authenticate different hosts through different methods on a single port.
Multiauthentication also supports MDA functionality on the voice VLAN by assigning authenticated devices to either a data
or voice VLAN depending on the VSAs received from the authentication server.
Note When a port is in multiauthentication mode, Guest VLAN and Authentication Failed VLAN will not
activate for data devices.
Pre-authentication Open Access
Beginning with Cisco IOS Release 12.2(50)SG, any of the four host modes can be additionally configured to allow a device to
gain network access before authentication. This preauthentication open access is useful in an application such as the Pre-boot
eXecution Environment (PXE), where a device must access the network to download a bootable image containing an
authentication client.
Enable preauthentication open access by entering the authentication open command after host mode configuration. It acts as
an extension to the configured host mode. For example, if preauthentication open access is enabled with single-host mode, then
the port allows only one MAC address. When preauthentication open access is enabled, initial traffic on the port is restricted
only by whatever other access restriction, independent of 802.1X, is configured on the port. If no access restriction other than
802.1X is configured on the port, then a client device has full access on the configured VLAN.
802.1X Violation Mode
You can use the authentication violation interface configuration command to configure the violation mode: restrict, shutdown,
and replace.
In single-host mode, a security violation is triggered when more than one device are detected on the data vlan. In multidomain
authentication mode, a security violation is triggered when more than one device are detected on the data or voice VLAN.
IP
Client IP phone Switch
Authentication
server
(RADIUS)
187640