Cisco Systems 4500 Enabling Multiple Hosts

40-80
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 40 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
Cisco IOS Release 12.2(46)SG or earlier
Switch# configure terminal
Switch(config)# interface fastethernet5/9
Switch(config-if)# switchport mode access
Switch(config-if)# dot1x pae authenticator
Switch(config-if)# dot1x reauthentication
Switch(config-if)# dot1x timeout reauth-period 4000
Switch(config-if)# dot1x port-control auto
Switch(config-if)# end
Switch#
Enabling Multiple Hosts
You can attach multiple hosts (clients) to a single 802.1X-enabled port as shown in Figure 40-9 on
page 40-26. In this mode, when the port is authorized, all other hosts that are indirectly attached to the
port are granted access to the network. If the port becomes unauthorized (reauthentication fails or an
EAPOL-logoff message is received), the switch denies access to the network for all wireless access
point-attached clients.
To allow multiple hosts (clients) on an 802.1X-authorized port that has the dot1x port-control interface
configuration command set to auto, perform this task:
Command Purpose
Step 1 Switch# configure terminal Enters global configuration mode.
Step 2 Switch(config)# interface
interface-id Enters interface configuration mode and specifies the interface to which
multiple hosts are indirectly attached.
Step 3 Switch(config-if)# switchport mode
access Specifies a nontrunking, nontagged single VLAN Layer 2 interface.
Step 4 Switch(config-if)# dot1x pae
authenticator Enables 802.1X authentication on the port with default parameters.
Refer to the “Default 802.1X Configuration” section on page 40-27.
Step 5 Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# authentication
host-mode multi-host
Cisco IOS Release 12.2(46)SG or earlier
releases
Switch(config-if)# dot1x host-mode
multi-host
Allows multiple hosts (clients) on an 802.1X-authorized port.
Note Ensure that the dot1x port-control interface configuration
command set is set to auto for the specified interface.
To disable multiple hosts on the port, use the
no authentication host-mode multi-host interface configuration
command (for earlier releases, use the no dot1x host-mode multi-host
interface configuration command).
Step 6 Cisco IOS Release 12.2(50)SG and later
Switch(config-if)# authentication
port-control auto
Cisco IOS Release 12.2(46)SG or earlier
releases
Switch(config-if)# dot1x
port-control auto
Enables 802.1X authentication on the interface.
Step 7 Switch(config-if)# end Returns to privileged EXEC mode.
Step 8 Switch# show dot1x all interface
interface-id Verifies your entries.
Step 9 Switch# copy running-config
startup-config (Optional) Saves your entries in the configuration file.