Cisco Systems 4500 802.1X Violation Mode

40-8
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 40 Configuring 802.1X Port-Based Authentication
About 802.1X Port-Based Authentication
Figure 40-5 Multidomain Authentication Mode Example
Figure 40-5 shows a typical MDA application with a single host behind an IP phone connected to the
802.1X-enabled port. Because the client is not directly connected to the switch, the switch cannot detect
a loss of port link if the client is disconnected. To prevent another device from using the established
authentication of the disconnected client later, Cisco IP phones send a Cisco Discovery Protocol (CDP)
host presence type length value (TLV) to notify the switch of changes in the attached client’s port link
state.
For details on how to configure MDA, see the “Using Multiple Domain Authentication and Multiple
Authentication” section on page 40-22.
Multiauthentication Mode
Available starting in Cisco IOS Release 12.2(50)SG, multiauthentication mode allows one client on the
voice VLAN and multiple authenticated clients on the data VLAN. When a hub or access point is
connected to an 802.1X port, multiauthentication mode provides enhanced security over multiple-hosts
mode by requiring authentication of each connected client. For non-802.1X devices, you can use MAB
or web-based authentication as the fallback method for individual host authentications, allowing you to
authenticate different hosts through different methods on a single port.
Multiauthentication also supports MDA functionality on the voice VLAN by assigning authenticated
devices to either a data or voice VLAN depending on the VSAs received from the authentication server.
Note When a port is in multiauthentication mode, Guest VLAN and Authentication Failed VLAN will not
activate for data devices.
Pre-authentication Open Access
Beginning with Cisco IOS Release 12.2(50)SG, any of the four host modes can be additionally
configured to allow a device to gain network access before authentication. This preauthentication open
access is useful in an application such as the Pre-boot eXecution Environment (PXE), where a device
must access the network to download a bootable image containing an authentication client.
Enable preauthentication open access by entering the authentication open command after host mode
configuration. It acts as an extension to the configured host mode. For example, if preauthentication open
access is enabled with single-host mode, then the port allows only one MAC address. When
preauthentication open access is enabled, initial traffic on the port is restricted only by whatever other
access restriction, independent of 802.1X, is configured on the port. If no access restriction other than
802.1X is configured on the port, then a client device has full access on the configured VLAN.
802.1X Violation Mode
You can use the authentication violation interface configuration command to configure the violation
mode: restrict, shutdown, and replace.
IP
Client IP phone Switch
Authentication
server
(RADIUS)
187640