Cisco Systems 4500 Single-Host Mode, Multiple-Hosts Mode, Multidomain Authentication Mode

40-7
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication
• Pre-authentication Open Access, page 40-8
Single-Host Mode
You can configure an 802.1X port for single-host or multiple-hosts mode. In single-host mode (see
Figure 40-1 on page 40-3), only one client can be connected to the 802.1X-enabled switch port. The
switch detects the client by sending an EAPOL frame when the port link state changes to the up state. If
a client leaves or is replaced with another client, the switch changes the port link state to down, and the
port returns to the unauthorized state.
Multiple-Hosts Mode
In multiple-hosts mode, you can attach multiple hosts to a single 802.1X-enabled port. Figure 40-4 on
page 40-7 shows 802.1X port-based authentication in a wireless LAN. In this mode, only one of the
attached clients must be authorized for all clients to be granted network access. If the port becomes
unauthorized (reauthentication fails or an EAPOL-logoff message is received), the switch denies
network access to all of the attached clients. In this topology, the wireless access point is responsible for
authenticating the clients attached to it, and it also acts as a client to the switch.
With multiple-hosts mode enabled, you can use 802.1X authentication to authenticate the port and port
security to manage network access for all MAC addresses, including that of the client.
Figure 40-4 Multiple Host Mode Example
Multidomain Authentication Mode
Beginning with Cisco IOS Release 12.2(37)SG, Catalyst 4500 series switches support Multidomain
Authentication (MDA), which allows an IP phone (Cisco or third-party) and a single host behind the IP
phone to authenticate independently, using 802.1X, MAC authentication bypass (MAB) or (for the host
only) web-based authentication. In this application, multidomain refers to two domains — data and voice
— and only two MAC addresses are allowed per-port. A switch can place the host in the data VLAN and
the IP phone in the voice VLAN, even though they appear on the same switch port. The data VLAN and
the voice VLAN can be specified in the CLI configuration. The devices are identified as either data or
voice depending on the vendor-specific-attributes (VSAs) received from the authentication,
authorization, and accounting (AAA) server. The data and voice VLANs can also be obtained from the
VSAs received from the (AAA) server during authentication.
101227
Wireless clients
Access point
Authentication
server
(RADIUS)