Cisco Systems 3750E VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible Authentication Bypass

10-24
Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-02
Chapter10 Configuring IEEE 802.1x Port-Based Authentication
Configuring IEEE 802.1x Authentication
– EtherChannel port—Do not configure a port that is an act ive or a not-yet-active member of an
EtherChannel as an IEEE 802.1x port. If you try to enable IEEE 802.1x authentication on an
EtherChannel port, an error message appears, and IEEE 802.1x authentication is not enabled.
– Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) destination ports—You can
enable IEEE 802.1x authentication on a port that is a SPAN or RSPAN destination port.
However, IEEE 802.1x authentication is disabled until the port is removed as a SPAN or
RSPAN destination port. You can enable IEEE 802.1x authentication on a SPAN or RSPAN
source port.
•Before globally enabling IEEE 802.1x authentication on a switch by entering the dot1x
system-auth-control global configuration command, remove the EtherChannel configuration from
the interfaces on which IEEE 802.1x authentication a nd EtherChannel are configured.
•If you are using a device running the Cisco Access Control Server (ACS) appli cation for
IEEE 802.1x authentication with EAP-Transparent LAN Services ( TLS) and EAP-MD5, make sure
that the device is running ACS Version 3.2.1 or later.
VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible Authentication Bypass
These are the configuration guidelines for VLAN assignment, guest VLAN, restricted VLAN, and
inaccessible authentication bypass:
•When IEEE 802.1x authentication is enabled on a port, you cannot configure a port VLAN that is
equal to a voice VLAN.
•The IEEE 802.1x authentication with VLAN assignment feature is not supported on trunk ports,
dynamic ports, or with dynamic-access port assignment through a VMPS.
•You can configure IEEE 802.1x authentication on a private-VLAN port, but do not configure
IEEE802.1x authentication with port security, a voice VLAN, a guest VLAN, a restricted VLAN,
or a per-user ACL on private-VLAN ports.
•You can configure any VLAN except an RSPAN VLAN, private VLAN, or a voice VLAN as an
IEEE 802.1x guest VLAN. The guest VLAN feature i s not supported on internal VLANs (routed
ports) or trunk ports; it is supported only on access ports.
•After you configure a guest VLAN for an IEEE 802.1x port to which a DHCP client is connected,
you might need to get a host IP address from a DHCP server. You can change the settings for
restarting the IEEE 802.1x authentication process on the switch before the DHCP process on the
client times out and tries to get a host IP address from the DHCP server. Decrease the settings for
the IEEE 802.1x authentication process (dot1x timeout quiet-period and dot1x timeout tx-period
interface configuration commands). The amount to decrease the settings depends on t he connected
IEEE 802.1x client type.
•When configuring the inaccessible authentication bypass feature, follow these guidelines:
– The feature is supported on IEEE 802.1x port in single-host m ode and multihosts mode.
– If the client is running Windows XP and the port to which the client is connected is in the
critical-authentication state, Windows XP might report that the interface is not authenticated.
– If the Windows XP client is configured for DHCP and has an IP address from the DHCP server,
receiving an EAP-Success message on a critical port might not re-initiate the DHCP
configuration process.