13-3

Cisco IE 2000 Switch Software Configuration Guide
OL-25866-01
Chapter 13 Configuring IEEE 802.1x Port-Based Authentication
Information About Configuring IEEE 802.1x Port-Based Authentication
Authentication Process

When 802.1x port-based authentication is enabled and the c lient supports 802.1x-compliant client

software, these events occur:

• If the client identity is valid and the 802.1x authentication succeeds, the switch grants the client

access to the network.

• If 802.1x authentication times out while waiting for an EAPO L message exchange and MAC

authentication bypass is enabled, the switch can use the client MAC address for authorization. If the

client MAC address is valid and the authorization succeeds, the switch grants the client access to the

network. If the client MAC address is invalid and the authorization fails, the switch assigns the client

to a guest VLAN that provides limited services if a guest VLA N is configured.

• If the switch gets an invalid identity from an 802.1x-capable client and a restricted VLAN is

specified, the switch can assign the client to a restricted VLAN that provides limited services.

• If the RADIUS authentication server is unavailable (down) and inaccessible authentication bypass

is enabled, the switch grants the client access to the network by putting the port in the

critical-authentication state in the RADIUS-configured or the user-specified access VLAN.

Note Inaccessible authentication bypass is also referred to as critical authentication or the AAA fail

policy.

Figure 13-2 Authentication Flowchart

281594
Client
identity is
invalid
All authentication
servers are down.
All authentication
servers are down.
Client
identity is
valid
The switch gets an
EAPOL message,
and the EAPOL
message
exchange begins.
1 = This occurs if the switch does not
detect EAPOL packets from the client.
Client MAC
address
identity
is invalid.
Client MAC
address
identity
is valid.
YesYesNo
IEEE 802.1x authentication
process times out.
Start IEEE 802.1x port-based
authentication.
Use inaccessible
authentication bypass
(critical authentication)
to assign the critical
port to a VLAN.
1
Use MAC authentication
bypass.
Assign the port to
a VLAN.
Assign the port to
a restricted VLAN.
Done
Assign the port to
a guest VLAN.
Done Done
Done
Assign the port to
a VLAN.
Done
1
Assign the port to
a guest VLAN.
Done
Is the client IEEE
802.1x capable?
Start
Is MAC authentication
bypass enabled?1
User does not have a
certificate but the system
previously logged on to
the network using
a computer certificate.
No