40-35
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Authentication
This example shows how to enable 802.1X authentication and to allow multiple hosts:
Cisco IOS Release 12.2(50)SG and later
Switch(config)# interface gigabitethernet2/1
Switch(config-if)# authentication port-control auto
Switch(config-if)# authentication host-mode multi-host
Switch(config-if)# end
Cisco IOS Release 12.2(46)SG or earlier
Switch(config)# interface gigabitethernet2/1
Switch(config-if)# dot1x port-control auto
Switch(config-if)# dot1x host-mode multi-host
Switch(config-if)# end
Step 4 Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# [no]
authentication host-mode
{single-host | multi-host |
multi-domain} | multi-auth}
Cisco IOS Release 12.2(46)SG or earlier
releases
Switch(config-if)# [no] dot1x
host-mode {single-host | multi-host
| multi-domain}
The keywords allow the following:
• single-host—Single-host (client) on an IEEE 802.1X-authorized
port.
• multi-host—Multiple-hosts on an 802.1X-authorized port after a
authenticating a single host.
• multi-domain—Both a host and a voice device (such as an IP phone,
Cisco or non-Cisco), to authenticate on an IEEE 802.1X-authorized
port.
Note You must configure a voice VLAN for an IP phone whe n the h ost
mode is set to multi-domain. For more information, see
Chapter 38, “Configuring Voice Interfaces.”
• multi-auth—Allows multiple hosts and a voice device, such as an IP
phone (Cisco or non-Cisco), to be authenticated on an IEEE
802.1x-authorized port. This keyword requires Cisco IOS Release
12.2(50)SG or a later release.
Ensure that the dot1x port-control interface configuration command is
set to auto for the specified interface.
To disable multiple hosts on the port, use the
no authentication host-mode {multi-host | multi-domain | multi-auth}
interface configuration command (for earlier releases, use the
no dot1x host-mode {multi-host | multi-domain} interface
configuration command).
Step 5 Switch(config-if)# switchport voice
vlan vlan-id (Optional) Configures the voice VLAN.
Step 6 Switch(config-if)# end Returns to privileged EXEC mode.
Step 7 Switch# show dot1x interface
interface-id [detail]Verifies your entries.
Step 8 Switch# copy running-config
startup-config (Optional) Saves your entries in the configuration file.
Command Purpose