40-74
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 40 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
Step 3 Switch(config-fallback-profile)# ip access-group
rule-name in Specifies the default ACL to apply to network traffic
before web-based authentication.
Step 4 Switch(config-fallback-profile)# ip admission
name rule-name Associates an IP admission rule with the profile and
specifies that a client connecting by web-based
authentication uses this rule.
Step 5 Switch(config-fallback-profile)# exit Returns to global configuration mode.
Step 6 Switch(config)# interface type slot/port Specifies the port to be configured and enters interface
configuration mode.
type = fastethernet, gigabitethernet, or
tengigabitethernet
Step 7 Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# authentication port-control
auto
Cisco IOS Release 12.2(46)SG or earlier releases
Switch(config-if)# dot1x port-control auto
Enables authentication on the port.
Step 8 Switch(config-if)# authentication order method1
[method2] [method3](Optional) Specifies the fallback order of authentication
methods to be used. The three values of method, in the
default order, are dot1x, mab, and webauth. The
specified order also determines the relative priority of the
methods for reauthentication (highest to lowest).
Step 9 Switch(config-if)# authentication priority
method1 [method2] [method3](Optional) Overrides the relative priority of
authentication methods to be used. The three values of
method, in the default order of priority, are dot1x, mab,
and webauth.
Step 10 Switch(config-if)# authentication event fail
action next-method Specifies that the next configured authentication method
be applied if authentication fails.
Step 11 Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# mab [eap]
Cisco IOS Release 12.2(46)SG or earlier releases
Switch(config-if)# dot1x mac-auth-bypass [eap]
Enables MAC authentication bypass. The optional eap
keyword specifies that the EAP extension be used during
RADIUS authentication.
Step 12 Switch(config-if)# authentication fallback
profile-name Enables web-based authentication using the specified
profile.
Step 13 Switch(config-if)# authentication violation
[shutdown | restrict](Optional) Configures the disposition of the port if a
security violation occurs. The default action is to shut
down the port. If the restrict keyword is configured, the
port does not shut down, but trap entries are installed for
the violating MAC address, and traffic from that MAC
address is dropped.
Step 14 Switch(config-if)# authentication timer
inactivity {seconds | server}(Optional) Configures the inactivity timeout value for
MAB and 802.1X. By default, inactivity aging is disabled
for a port.
• seconds—Specifies inactivity timeout period. The
range is from 1 to 65535 seconds.
• server—Specifies that the inactivity timeout period
value be obtained from the authentication server.
Command Purpose