10-6
Catalyst2950 and Catalyst2955 Switch Software Configuration Guide
78-11380-10
Chapter10 Configuring 802.1x Port-Based Authentication
Understanding 802.1x Port-Based Authentication
Figure10-3 Wireless LAN Example
Using 802.1x with Port Security
For switches running the enhanced software image (EI), you can enable an 802 .1x port for port security
in either single-host or multiple-hosts mode. (You must also conf igure port sec urity on the p ort b y using
the switchport port-security interface configuration command.) When you enable port secur it y a nd
802.1x on a port, 802.1x authenticates the port, and port security manag es net work ac cess for all MAC
addresses, including that of the client. You can then limit the number or group of clients that can access
the network through an 802.1x port.
These are some examples of the interaction between 802.1x and port security on the switch:
•When a client is authenticated, and the port security table is not full, the client’s MAC address is
added to the port security list of secure hosts. The p ort th en pr ocee ds to co me up n orm al ly.
When a client is authenticated and manually configured for port security, it is guaranteed an entry
in the secure host table (unless port security static aging has been enabled).
A security violation occurs if the client is authenticated, but port security table is full. This can
happen if the maximum number of secure hosts has been statically configured, or if the client ages
out of the secure host table. If the client’s address is aged out, its place in the secure ho st tabl e ca n
be taken by another host.
The port security violation modes determine the action for se curi ty vi olatio ns . For mo re
information, see the “Security Violations” section on page 22 -8.
•When an 802.1x client logs off, the port transitions back to an unauthenticated sta te, and all dynamic
entries in the secure host table are cleared, including the entry for the clien t . Norm al authentication
then takes place.
•If the port is administratively shut down, the port becomes unauthenticated, and all dynamic entries
are removed from the secure host table.
•Port security and a voice VLAN can be configured simultaneously on an 802.1x port t hat is in either
single-host or multiple-hosts mode. Port security applies to both the voice VLAN identif ier (VVID)
and the port VLAN identifier (PVID).
•When an 802.1x client address is manually removed from the port security table, we recommend
that you re-authenticate the client by entering the dot1x re-authenticate privileged EXEC
command.
For more information about enabling port security on your switch, see the “Configuring Port Security”
section on page 22-7.
101227
Wireless clients
Access point
Authentication
server
(RADIUS)