10-14
Cisco IE 3010 Switch Software Configuration Guide
OL-23145-01
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
When a MAC address moves from one port to another, the switch terminates the authenticated session
on the original port and initiates a new authentication sequence on the new port. Port security behavior
remains the same when you configure MAC move.
The MAC move feature applies to both voice and data hosts.
Note In open authentication mode, a MAC address is immediately moved from the original port to the new
port, with no requirement for authorization on the new port.
For more information see the “Enabling MAC Move” section on page 10-48.
MAC Replace
Beginning with Cisco IOS Release 12.2(55)SE, the MAC replace feature can b e configured to address
the violation that occurs when a host attempts to connect to a port where another host was previously
authenticated.
Note This feature does not apply to ports in multi-auth mode, because violations are not triggered in that
mode. It does not apply to ports in multiple host mode, because in that mode, only the first host requires
authentication.
If you configure the authentication violation interface configuration command with the replace
keyword, the authentication process on a port in multi-domain m ode is:
• A new MAC address is received on a port with an existing authen ticated MAC address.
• The authentication manager replaces the MAC address of the current data host on the port with the
new MAC address.
• The authentication manager initiates the authentication process for the new MAC address.
• If the authentication manager determines that the new host is a voice host, the original voice host is
removed.
If a port is in open authentication mode, any new MAC address is immediately added to the MAC address
table.
For more information see the “Enabling MAC Replace” section on page 10-49.
802.1x Accounting
The 802.1x standard defines how users are authorized and authenticated for network access but does not
keep track of network usage. 802.1x accounting is disabled by default. You can enable 802.1x accounting
to monitor this activity on 802.1x-enabled ports:
• User successfully authenticates.
• User logs off.
• Link-down occurs.
• Re-authentication successfully occurs.
• Re-authentication fails.