Cisco Systems 3750E manual Configuring a Guest Vlan, 10-33

Chapter 10 Configuring IEEE 802.1x Port-Based Authentication

Configuring IEEE 802.1x Authentication

Note You must configure the RADIUS server to perform accounting tasks, such as logging start, stop, and interim-update messages and time stamps. To turn on these functions, enable logging of “Update/Watchdog packets from this AAA client” in your RADIUS server Network Configuration tab. Next, enable “CVS RADIUS Accounting” in your RADIUS server System Configuration tab.

Beginning in privileged EXEC mode, follow these steps to configure IEEE 802.1x accounting after AAA is enabled on your switch. This procedure is optional.

	Command	Purpose
Step 1
	configure terminal	Enter global configuration mode.
Step 2
	interface interface-id	Specify the port to be configured, and enter interface configuration mode.
Step 3
	aaa accounting dot1x default	Enable IEEE 802.1x accounting using the list of all RADIUS servers.
	start-stop group radius
Step 4
	aaa accounting system default	(Optional) Enables system accounting (using the list of all RADIUS
	start-stop group radius	servers) and generates system accounting reload event messages when the
		switch reloads.
Step 5
	end	Return to privileged EXEc mode.
Step 6
	show running-config	Verify your entries.
Step 7
	copy running-config startup-config	(Optional) Saves your entries in the configuration file.

Use the show radius statistics privileged EXEC command to display the number of RADIUS messages that do not receive the accounting response message.

This example shows how to configure IEEE 802.1x accounting. The first command configures the RADIUS server, specifying 1813 as the UDP port for accounting:

Switch(config)# radius-server host 172.120.39.46 auth-port 1812 acct-port 1813 key rad123 Switch(config)# aaa accounting dot1x default start-stop group radius

Switch(config)# aaa accounting system default start-stop group radius

Configuring a Guest VLAN

When you configure a guest VLAN, clients that are not IEEE 802.1x-capable are put into the guest VLAN when the server does not receive a response to its EAP request/identity frame. Clients that are IEEE 802.1x-capable but that fail authentication are not granted network access. The switch supports guest VLANs in single-host or multiple-hosts mode.

Beginning in privileged EXEC mode, follow these steps to configure a guest VLAN. This procedure is optional.

	Command	Purpose
Step 1
	configure terminal	Enter global configuration mode.
Step 2
	interface interface-id	Specify the port to be configured, and enter interface configuration mode.
		For the supported port types, see the “IEEE 802.1x Authentication
		Configuration Guidelines” section on page 10-23.

	Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-02		10-33