Cisco Systems 4500 Configuring Violation Action

40-54
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 40 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
This example shows how to globally enable MAC replace on a switch:
Switch# configure terminal
Switch(config)# interface f7/1
Switch(config-if)# authentication violation replace
The following syslog messages displays when MAC-replace occurs:
%AUTHMGR-5-SECUREMACREPLACE: <mac-addr> replaced <mac-addr> on <interface-name>
Configuring Violation Action
You can configure 802.1X security violation behavior as either shutdown, restrict, or replace mode,
based on the response to the violation.
To configure the violation action, performing the following task:
This example shows how to configure the violation mode shutdown on a switch:
Switch# configure terminal
Switch(config)# authentication violation shutdown
A port is error-disabled when a security violation triggers on shutdown mode. The following syslog
messages displays:
%AUTHMGR-5-SECURITY_VIOLATION: Security violation on the interface <interface name>, new
MAC address <mac-address> is seen.
Step 3 Switch(config-if)# authentication
violation [restrict | shutdown |
replace]
Tears down the old session and authenticates the new host, when a new
host is seen in single or multiple- domain modes.
Step 4 Switch(config-if)# end Returns to privileged EXEC mode.
Step 5 Switch# show run Verifies your entries.
Step 6 Switch # copy running-config
startup-config (Optional) Saves your entries in the configuration file.
Command Purpose
Command Purpose
Step 1 Switch# configure terminal Enters global configuration mode.
Step 2 Switch(config)# interface
interface-id Enters interface configuration mode.
Step 3 Switch(config-if)# authentication
violation [restrict |
shutdown | replace]
(Optional) Configures the disposition of the port if a security violation
occurs.
The default action is to shut down the port. If the restrict keyword is
configured, the port does not shut down.
When a new host is seen in single or multiple- domain modes, replace
mode tears down the old session and authenticates the new host.
Step 4 Switch(config-if)# end Returns to privileged EXEC mode.
Step 5 Switch# show run Verifies your entries.
Step 6 Switch # copy running-config
startup-config (Optional) Saves your entries in the configuration file.