13-26
Cisco IE 2000 Switch Software Configuration Guide
OL-25866-01
Chapter 13 Configuring IEEE 802.1x Port-Based Authentication
Information About Configuring IEEE 802.1x Port-Based Authentication
Network admission control (NAC) Layer 2 IP validation—This feature takes effect after an 802.1x
port is authenticated with MAC authentication bypass, including hosts in the exception list.
Network Edge Access Topology (NEAT)—MAB and NEAT are mutually exclusive. You cannot
enable MAB when NEAT is enabled on an interface, and you cannot enable NEAT when MAB is
enabled on an interface.
For more configuration information, see the Authentication Manager” section on page 13-6.
Cisco IOS Release 12.2(55)SE and later supports filtering of verbose MAB system messages. See the
“Authentication Manager CLI Commands” section on page 13-8.
802.1x User Distribution
You can configure 802.1x user distribution to load-balance users with the same group name across
multiple different VLANs.
The VLANs are either supplied by the RADIUS server or configured through the switch CLI under a
VLAN group name.
Configure the RADIUS server to send more than one VLAN name for a user. The multiple VLAN
names can be sent as part of the response to the user. The 802.1x user distribution trac ks all the users
in a particular VLAN and achieves load balancing by moving the authorized user to the least
populated VLAN.
Configure the RADIUS server to send a VLAN group name for a user. The VLAN group name ca n
be sent as part of the response to the user. You can search for the selected VLAN group name among
the VLAN group names that you configured by using the switch CLI. If the VLAN group name is
found, the corresponding VLANs under this VLAN group n ame are searched to find the least
populated VLAN. Load balancing is achieved by moving the corresponding aut horized user to that
VLAN.
Note The RADIUS server can send the VLAN information in any combination of VLAN-IDs, VLAN
names, or VLAN groups.

802.1x User Distribution Configuration Guidelines

Confirm that at least one VLAN is mapped to the VLAN group.
You can map more than one VLAN to a VLAN group.
You can modify the VLAN group by adding or deleting a VLAN.
When you clear an existing VLAN from the VLAN group name, none of the authenticated ports in
the VLAN are cleared, but the mappings are removed from the existing VLAN group.
If you clear the last VLAN from the VLAN group name, the VLAN group is cleared.
You can clear a VLAN group even when the active VLANs are mapped to the group. When you clear
a VLAN group, none of the ports or users that are in the authenticated state in any VLAN with in the
group are cleared, but the VLAN mappings to the VLAN g roup are cleared.
For more information, see the “Configuring 802.1x User Distribution” section on page 13-46.