Cisco Systems 3750E manual 10-4, Authentication Flowchart

Chapter 10 Configuring IEEE 802.1x Port-Based Authentication

Understanding IEEE 802.1x Port-Based Authentication

Figure 10-2shows the authentication process.

If Multi Domain Authentication (MDA) is enabled on a port, this flow can be used with some exceptions that are applicable to voice authorization. For more information on MDA, see “Using Multidomain Authentication” section on page 10-19.

Figure 10-2

Authentication Flowchart

Start

No

Is the client IEEE

IEEE 802.1x authentication

Is MAC authentication

802.1x capable?

process times out.

bypass enabled? 1

Yes

Yes

No

The switch gets an

EAPOL message,

and the EAPOL

message

Start IEEE 802.1x port-based

exchange begins.

Use MAC authentication

authentication.

bypass. 1

Client

Client

Client MAC

Client MAC

identity is

identity is

address

address

invalid

valid

identity

identity

is valid.

is invalid.

Assign the port to

Assign the port to

Assign the port to

Assign the port to

a restricted VLAN.

a VLAN.

a VLAN.

a guest VLAN.1

141679

Done

Done

Done

Done

All authentication

All authentication

servers are down.

servers are down.

Use inaccessible

authentication bypass (critical authentication) to assign the critical port to a VLAN.

Done

1 = This occurs if the switch does not detect EAPOL packets from the client.

The switch re-authenticates a client when one of these situations occurs:

•Periodic re-authentication is enabled, and the re-authentication timer expires.

You can configure the re-authentication timer to use a switch-specific value or to be based on values from the RADIUS server.

After IEEE 802.1x authentication using a RADIUS server is configured, the switch uses timers based on the Session-Timeout RADIUS attribute (Attribute[27]) and the Termination-Action RADIUS attribute (Attribute [29]).

Catalyst 3750-E and 3560-E Switch Software Configuration Guide

10-4 OL-9775-02