Cisco Systems 4500 Using 802.1X for Guest VLANs

40-11
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication
• Enable AAA authorization by using the network keyword to allow interface configuration from the
RADIUS server. For an illustration of how to apply the aaa authorization network group radius
command, refer to the section “Enabling 802.1X Authentication” on page 28.
• Enable 802.1X. (The VLAN assignment feature is automatically enabled when you configure
802.1X on an access port.)
• Assign vendor-specific tunnel attributes in the RADIUS server. T o ensure proper VLAN assignment,
the RADIUS server must return these attributes to the switch:
– Tunnel-Type = VLAN
– Tunnel-Medium-Type = 802
– Tunnel-Private-Group-ID = VLAN NAME
Using 802.1X for Guest VLANs
You can use guest VLANs to enable non-802.1X-capable hosts to access networks that use 802.1X
authentication. For example, you can use guest VLANs while you are upgrading your system to support
802.1X authentication.
Guest VLANs are supported on a per-port basis, and you can use any VLAN as a guest VLAN as long
as its type matches the type of the port. If a port is already forwarding on the guest VLAN and you enable
802.1X support on the network interface of the host, the port is immediately moved out of the guest
VLAN and the authenticator waits for authentication to occur.
Enabling 802.1X authentication on a port starts the 802.1X protocol. If the host fails to respond to
packets from the authenticator within a certain amount of time, the authenticator brings the port up in
the configured guest VLAN.
If the port is configured as a PVLAN host port, the guest VLAN must be a secondary PVLAN. If the
port is configured as an access port, the guest VLAN must be a regular VLAN. If the guest VLAN
configured on a port is not appropriate for the type of the port, the switch behaves as if no guest VLAN
is configured (that is, non-responsive hosts are denied network access).
For details on how to configure guest VLANs, see the “Configuring 802.1X with Guest VLANs” section
on page 40-55.
Usage Guidelines for Using 802.1X Authentication with Guest VLANs
When using 802.1X authentication with guest VLANs, consider these guidelines:
• When you reconfigure a guest VLAN to a different VLAN, any authentication failed ports are also
moved and the ports stay in their current authorized state.
• When you shut down or remove a guest VLAN from the VLAN database, any authentication failed
ports are immediately moved to an unauthorized state and the authentication process is restarted.
Note No periodic reauthentication is allowed with guest VLANs.