Cisco Systems DOC-7814982 802.1X Configuration Guidelines

8-7
Catalyst 2950 Desktop Switch Software Configuration Guide
78-14982-01
Chapter 8 Configuri ng 802.1X Port-Bas ed Authenticat ion Configuring 802.1X Authentication
802.1X Configuration Guidelines
These ar e the 80 2.1X authenti cation co nfigurati on guid elines :
•When 802.1 X is enabl ed, port s are auth enticat ed befor e any other Laye r 2 features ar e ena bled.
•The 802.1X protocol is supported on Layer 2 static-access ports, but it is not supported on these port
types:
– Trunk port—If you try to enable 802.1X on a trunk port, an error message appears, and 802.1X
is not enabled. If you try to change the mode of an 802.1X-enabled port to trunk, the port mode
is not cha nged.
– Dynamic p orts—A port in dyna mic mod e can negotiate with its nei ghbor to becom e a trunk
port. If yo u t ry t o ena ble 802.1 X on a dy na mic port , an e rror m essage app ears, a nd 80 2. 1X i s
not enabled. If you try to change the mode of an 802.1X-enabled port to dynamic, the port mode
is not cha nged.
– Dynamic-access ports—If you try to enab le 802.1X on a dynami c-acc ess (VLAN Q uery
Protocol [VQP]) port, an error message appears, and 802.1X is not enabled. If you try to change
an 8 02.1X -e nabl ed p ort to d yna mic V LAN as sig nme nt, a n error m es sag e ap pear s, an d th e
VLAN con figuratio n is not chan ged.
– Ether Channe l p ort —Befo re enabli ng 802.1 X on the port, you must first remove it from the
Ether Channe l. If yo u tr y to e nabl e 80 2.1 X on a n Ethe rC hanne l or o n a n a ctive port i n a n
EtherChannel, an error message appears, and 802.1X is not enabled. If you enable 802.1X on a
not-ye t active port of an Eth erChanne l, the port doe s not join the Et herChan nel.
– Secure port—You cannot configure a secure port as an 802.1X port. If you try to enable 802.1X
on a secure port, an error messa ge appears, a nd 802.1X is not enab led. If you try t o chang e an
802.1X-enabled port to a secure port, an error message appears, and the security settings are not
changed.
– Switched Port Analyzer (SPAN) destination port—You can enab le 802.1 X on a port that is a
SPAN d esti natio n port; however, 802.1X i s disa bled u ntil the po rt is re moved as a SPA N
destinati on. You can enabl e 802.1X on a SPAN sourc e port.