Cisco Systems 4500 802.1X Configuration Guidelines, Enabling 802.1X Authentication

40-28
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 40 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
802.1X Configuration Guidelines
Guidelines for configuring 802.1X authentication include the following:
• The 802.1X protocol is supported only on Layer 2 static access, PVLAN host ports, and Layer 3
routed ports. You cannot configure 802.1X for any other port modes.
• If you are planning to use VLAN assignment, be aware that the features use general AAA
commands. For information on how to configure AAA, refer to the “Enabling 802.1X
Authentication” section on page 40-28. Alternatively, you can refer to the Cisco IOS security
documentation at this location:
http://www.cisco.com/en/US/products/ps6586/products_ios_technology_home.html
Enabling 802.1X Authentication
To enable 802.1X port-based authentication, you first must enable 802.1X globally on your switch, then
enable AAA and specify the authentication method list. A method list describes the sequence and
authentication methods that must be queried to authenticate a user.
The software uses the first method listed in the method list to authenticate users; if that method fails to
respond, the software selects the next authentication method in the list. This process continues until there
is successful communication with a listed authentication method or until all defined methods are
exhausted. If authentication fails at any point in this cycle, the authentication process stops, and no other
authentication methods are attempted.
Retransmission time 30 sec
Number of seconds that the switch should wait for a response to
an EAP request/identity frame from the client before
retransmitting the request.
Maximum retransmission number 2
Number of times that the switch sends an EAP-request/identity
frame before restarting the authentication process.
Multiple host support Disabled
Client timeout period 30 sec
When relaying a request from the authentication server to the
client, the amount of time that the switch waits for a response
before retransmitting the request to the client.
Authentication server timeout period 30 sec
When relaying a response from the client to the authentication
server, the amount of time that the switch waits for a reply before
retransmitting the response to the server. This setting is not
configurable.
Table 40-1 Default 802.1X Configuration (continued)
Feature Default Setting