Cisco Systems IE3010 Configuring the Host Mode

10-43
Cisco IE 3010 Switch Software Configuration Guide
OL-23145-01
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Configuring 802.1x Authentication
You also need to configure some settings on the RADIUS server. These settings include the IP address
of the switch and the key string to be shared by both the server and the switch. For more information,
see the RADIUS server documentation.
Configuring the Host Mode
Beginning in privileged EXEC mode, follow these steps to allow a single host (client) or multiple hosts
on an 802.1x-authorized port. Use the multi-domain keyword to configure multidomain auth entication
(MDA) to enable authentication of both a host and a voice device, such as an IP phone (Cisco or
non-Cisco) on the same switch port.
This procedure is optional.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 radius-server vsa send authentication Configure the network access server to recognize and use vendor-specific
attributes (VSAs).
Step 3 interface interface-id Specify the port to which multiple hosts are indirectly attached, and enter
interface configuration mode.
Step 4 authentication host-mode [multi-auth |
multi-domain | multi-host |
single-host]
or
dot1x host-mode {single-host |
multi-host | multi-domain}
The keywords have these meanings:
• multi-auth–Allow one client on the voice VLAN and multiple
authenticated clients on the data VLAN. Each host is individually
authenticated.
Note The multi-auth keyword is only available with the
authentication host-mode command.
• multi-host–Allow multiple hosts on an 802.1x-authorized port after
a single host has been authenticated.
• multi-domain–Allow both a host and a voice device, such as an IP
phone (Cisco or non-Cisco), to be authenticated on
an 802.1x-authorized port.
Note You must configure the voice VLAN for the IP phone when the
host mode is set to multi-domain. For more information, see
Chapter 16, “Configuring Voice VLAN.”
• single-host–Allow a single host (client) on an 802.1x-authorized
port.
Make sure that the authentication port-control or dot1x port-control
interface configuration command set is set to auto for the specified
interface.
Step 5 switchport voice vlan vlan-id (Optional) Configure the voice VLAN.
Step 6 end Return to privileged EXEC mode.