Cisco Systems 4500 Configuring 802.1X Port-Based Authentication

CHAPT ER
40-1
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
40
Configuring 802.1X Port-Based Authentication
This chapter describes how to configure IEEE 802.1X port-based authentication on the Catalyst 4500
series switch to prevent unauthorized client devices from gaining access to the network.
This chapter includes the following major sections:
• About 802.1X Port-Based Authentication, page 40-1
• Configuring 802.1X Port-Based Authentication, page 40-26
• Controlling Switch Access with RADIUS, page 40-92
• Displaying 802.1X Statistics and Status, page 40-113
• Displaying Authentication Details, page 40-114
Note For complete syntax and usage information for the switch commands used in this chapter, look at the
Cisco Catalyst 4500 Series Switch Command Reference and related publications at this location:
http://www.cisco.com/en/US/products/hw/switches/ps4324/index.html
If the command is not found in the Catalyst 4500 Command Reference, it will be found in the larger
Cisco IOS library. Refer to the Cisco IOS Command Reference and related publications at this location:
http://www.cisco.com/en/US/products/ps6350/index.html
About 802.1X Port-Based Authentication
802.1X defines 802.1X port-based authentication as a client-server based access control and
authentication protocol that restricts unauthorized clients from connecting to a LAN through publicly
accessible ports. An authentication server validates each supplicant (client) connected to an
authenticator (network access switch) port before making available any services offered by the switch or
the LAN.
Note 802.1X support requires an authentication server that is configured for Remote Authentication Dial-In
User Service (RADIUS). 802.1X authentication does not work unless the network access switch can
route packets to the configured RADIUS server. To verify that the switch can route packets, you must
ping the server from the switch.