40-79
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Authentication
To enable periodic reauthentication of the client and to configure the number of seconds between
reauthentication attempts, perform this task:
This example shows how to enable periodic reauthentication and set the number of seconds between
reauthentication attempts to 4000:
Cisco IOS Release 12.2(50)SG and later
Switch# configure terminal
Switch(config)# interface fastethernet5/9
Switch(config-if)# switchport mode access
Switch(config-if)# dot1x pae authenticator
Switch(config-if)# authentication periodic
Switch(config-if)# authentication timer reauthenticate 4000
Switch(config-if)# authentication port-control auto
Switch(config-if)# end
Switch#
Command Purpose
Step 1 Switch# configure terminal Enters global configuration mode.
Step 2 Switch(config)# interface
interface-id Enters interface configuration mode and specifies the interface to be
enabled for periodic reauthentication.
Step 3 Switch(config-if)# switchport mode
access Specifies a nontrunking, nontagged single VLAN Layer 2 interface.
Step 4 Switch(config-if)# dot1x pae
authenticator Enables 802.1X authentication on the port with default parameters.
Refer to the “Default 802.1X Configuration” section on page 40-27.
Step 5 Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# authentication
periodic
Cisco IOS Release 12.2(46)SG or earlier
releases
Switch(config-if)# dot1x
reauthentication
Enables periodic reauthentication of the client, which is disabled by
default.
To disable periodic reauthentication, use the no authentication periodic
interface configuration command (for earlier releases, use the
no dot1x reauthentication interface configuration command).
Step 6 Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# authentication
timer reauthenticate {seconds |
server}
Cisco IOS Release 12.2(46)SG or earlier
releases
Switch(config-if)# dot1x timeout
reauth-period {seconds | server}
Specifies the number of seconds between reauthentication attempts or
have the switch use a RADIUS-provided session timeout.
The range is 1 to 65,535; the default is 3600 seconds.
To return to the default number of seconds between reauthentication
attempts, use the no authentication timer reauthenticate global
configuration command (for earlier releases, use the
dot1x timeout reauth-attempts command).
This command affects the behavior of the switch only if periodic
reauthentication is enabled.
Step 7 Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# authentication
port-control auto
Cisco IOS Release 12.2(46)SG or earlier
releases
Switch(config-if)# dot1x
port-control auto
Enables 802.1X authentication on the interface.
Step 8 Switch(config-if)# end Returns to privileged EXEC mode.