Cisco Systems 4500 Cisco TrustSec SGT Exchange Protocol (SXP) IPv4

1-25
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 1 Product Overview Security Features
• 802.1X with Inaccessible Authentication Bypass—Applies when the AAA servers are unreachable
or nonresponsive. In this situation, 802.1X user authentication typically fails with the port closed,
and the user is denied access. Inaccessible Authentication Bypass provides a configurable
alternative on the Catalyst 4500 series switch to grant a critical port network access in a locally
specified VLAN.
• 802.1X with Port Security—Allows port security on an 802.1X port in either single- or multiple-host
mode. When you enable port security and 802.1X on a port, 802.1X authenticates the port, and port
security manages the number of MAC addresses allowed on that port, including that of the client.
• 802.1X with MAC Authentication Bypass—Provides network access to agentless devices without
802.1X supplicant capabilities, such as printers. Upon detecting a new MAC address on a switch
port, the Catalyst 4500 series switch will proxy an 802.1X authentication request based on the
device’s MAC address.
• 802.1X with RADIUS-Provided Session Timeouts—Allows you to specify whether a switch uses a
locally configured or a RADIUS-provided reauthentication timeout.
• 802.1X with Unidirectional Controlled Port—Allows the Wake-on-LAN (WoL) magic packets to
reach a workstation attached to an unauthorized 802.1X switch port. Unidirectional Controlled Port
is typically used to send operating systems or software updates from a central server to workstations
at night.
• 802.1X with Violation Mode—This feature allows you to configure 802.1X security violation
behavior as either shutdown, restrict, or replace mode, based on the response to the violation.
• 802.1X with VLAN assignment—This feature allows you to enable non-802.1X-capable hosts to
access networks that use 802.1X authentication.
• 802.1X with VLAN user distribution—An alternative to dynamically assigning a VLAN ID or a
VLAN name, this feature assign a VLAN Group name. It enables you to distribute users belonging
to the same group (and characterized by a common VLAN Group name) across multiple VLANs.
Ordinarily, you do this to avoid creating an overly large broadcast domain.
• 802.1X with Voice VLAN—This feature allows you to use 802.1X security on a port while enabl ing
it to be used by both Cisco IP phones and devices with 802.1X supplicant support.
• Multi-Domain Authentication—This feature allows both a data device and a voice device, such as
an IP phone (Cisco or non-Cisco), to authenticate on the same switch port, which is divided into a
data domain and a voice domain.
• RADIUS Change of Authorization—This feature employs Change of Authorization (CoA)
extensions defined in RFC 5176 in a push model to allow for the dynamic reconfiguring of sessions
from external authentication, authorization, and accounting (AAA) or policy servers.
For more information on 802.1X identity-based network security, see Chapter 40, “Configuring 802.1X
Port-Based Authentication.”
Cisco TrustSec SGT Exchange Protocol (SXP) IPv4
TrustSec Security Group Tag Exchange Protocol (SXP) IPv4 is a solution migration protocol dev eloped
to provide a mechanism for legacy switches (not tag capable) to participate in a TrustSec network. The
IPv4 to SGT binding is communicated out of band to the SXP peer. The SXP peer will populate a local
binding table. If the peer is an egress switch it will use these bindings to do SGACL enforcement. If the
peer is configured as a distribution SXP switch to improve scaling, then the binding table updates will
be provided to the egress switch by the distribution switch.
For more information, refer to the following URLs: