Cisco Systems 3750E manual 10-37

Chapter 10 Configuring IEEE 802.1x Port-Based Authentication

Configuring IEEE 802.1x Authentication

	Command	Purpose
Step 4 radius-server host ip-address		(Optional) Configure the RADIUS server parameters by using these
	[acct-port udp-port][auth-port	keywords:
	udp-port][test username name	• acct-portudp-port—Specify the UDP port for the RADIUS
	[idle-time time] [ignore-acct-port]
		accounting server. The range for the UDP port number is from 0 to
	[ignore-auth-port]] [key string]
		65536. The default is 1646.
		• auth-portudp-port—Specify the UDP port for the RADIUS
		authentication server. The range for the UDP port number is from 0
		to 65536. The default is 1645.
		Note You should configure the UDP port for the RADIUS accounting
		server and the UDP port for the RADIUS authentication server to
		nondefault values.
		• test username name—Enable automated testing of the RADIUS
		server status, and specify the username to be used.
		• idle-timetime—Set the interval of time in minutes after which the
		switch sends test packets to the server. The range is from 1 to
		35791 minutes. The default is 60 minutes (1 hour).
		• ignore-acct-port—Disable testing on the RADIUS-server
		accounting port.
		• ignore-auth-port—Disable testing on the RADIUS-server
		authentication port.
		• For key string, specify the authentication and encryption key used
		between the switch and the RADIUS daemon running on the
		RADIUS server. The key is a text string that must match the
		encryption key used on the RADIUS server.
		Note Always configure the key as the last item in the radius-server
		host command syntax because leading spaces are ignored, but
		spaces within and at the end of the key are used. If you use spaces
		in the key, do not enclose the key in quotation marks unless the
		quotation marks are part of the key. This key must match the
		encryption used on the RADIUS daemon.
		You can also configure the authentication and encryption key by
		using the radius-server key {0 string 7 string string} global
		configuration command.
Step 5 dot1x critical {eapol recovery delay		(Optional) Configure the parameters for inaccessible authentication
	milliseconds}	bypass:
		eapol—Specify that the switch sends an EAPOL-Success message when
		the switch successfully authenticates the critical port.
		recovery delay milliseconds—Set the recovery delay period during
		which the switch waits to re-initialize a critical port when a RADIUS
		server that was unavailable becomes available. The range is from 1 to
		10000 milliseconds. The default is 1000 milliseconds (a port can be
		re-initialized every second).

	Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-02		10-37