Cisco Systems 4500 Manually Reauthenticating a Client Connected to a Port, Initializing the 802.1X Authentication State

40-91
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Authentication
• Although modified trunk parameters are retained, when the trunk link is down or authentication is
cleared, the interface is reconfigured to the following:
– spanning-tree portfast
– switchport mode access
– switchport access vlan access-vlan-id
Note access-vlan-id is derived from the switchport trunk native vlan x command entered on the
interface. If you have modified the trunk native VLAN, the configured native VLAN is used
as the access-vlan-id when the port returns to access mode.
• We recommend using 802.1X authentication mode single-host for NEAT configuration on the
interface.
• The cisco-av-pairs must be configured as device-traffic-class=switch on the ACS. This sets the
interface as a trunk after the supplicant is successfully authenticated.
• You should not modify the trunk mode configurations that are based on device-traffic-class either
manually or through features such as AutoSmart Ports. it is because 802.1X configuration is not
supported for trunk ports.
• To change the host mode and apply a standard port configuration on the authenticator switch port,
you can also use AutoSmart ports user-defined macros rather than the switch VSA. Doing this
allows you to remove unsupported configurations on the authenticator switch port and to change the
port mode from access to trunk. For details, see Chapter 13, “Configuring Auto Smartports Macros”.
Note Configuring only the Auto SmartPorts macro does not identify the end host as a supplicant
switch. The switch VSA is required to identify the supplicant switch. However, when Auto
Smartports macro is configured, the internal macro that reconfigures the port from access to
trunk is not executed and the Auto Smartports macro should ensure that the port reconfigures as
a trunk port.
Manually Reauthenticating a Client Connected to a Port
You can manually reauthenticate a client connected to a specific port at any time by entering the
dot1x re-authenticate interface privileged EXEC command. If you want to enable or disable periodic
reauthentication, see the “Enabling Periodic Reauthentication” section on page 40-78.
This example shows how to manually reauthenticate the client connected to Fast Ethernet port 1/1:
Switch# dot1x re-authenticate interface fastethernet1/1
Starting reauthentication on FastEthernet1/1
Initializing the 802.1X Authentication State
The dot1x initialize command causes the authentication process to be restarted regardless of its current
state.
This example shows how to restart the authentication process on Fast Ethernet port 1/1:
Switch# dot1x initialize interface fastethernet1/1
This example shows how to restart the authentication process on all ports of the switch: