Cisco Systems IE 2000 Open1x Authentication, 802.1x Supplicant and Authenticator Switches with Network Edge Access Topology (NEAT)

13-28
Cisco IE 2000 Switch Software Configuration Guide
OL-25866-01
Chapter 13 Configuring IEEE 802.1x Port-Based Authentication
Information About Configuring IEEE 802.1x Port-Based Authentication
Open1x Authentication
Open1x authentication allows a device access to a port before that device is authenticated. When open
authentication is configured, a new host can pass traffic according to the access control list (ACL)
defined on the port. After the host is authenticated, the policies configured on the RADIUS server are
applied to that host.
You can configure open authentication with these scenarios:
• Single-host mode with open authentication—Only one user is allowed network access before and
after authentication.
• MDA mode with open authentication—Only one user in the voice domai n and one user in the data
domain are allowed.
• Multiple-hosts mode with open authentication—Any host can access the network.
• Multiple-authentication mode with open authentication—Similar to MDA, except multiple hosts can
be authenticated.
For more information see the “Configuring the Host Mode” section on page 13-38.
Note If open authentication is configured, it takes precedence over other authentication controls. This means
that if you use the authentication open interface configuration command, the port will grant access to
the host irrespective of the authentication port-control interface configuration command.
802.1x Supplicant and Authenticator Switches with Network Edge Access
Topology (NEAT)
The Network Edge Access Topology (NEAT) feature extends identity to areas outside the wiring closet
(such as conference rooms). This allows any type of device to authenticate on the port.
• You can configure a switch to act as a supplicant to another switch by using the 802.1x supplicant
feature. This configuration is helpful in a scenario, where, for example, a switch is outside a wiring
closet and is connected to an upstream switch through a trunk port. A switch configured with the
802.1x switch supplicant feature authenticates with the upstream switch for secure connectivity.
Once the supplicant switch authenticates successfully the port mode changes from access to trunk.
• If the access VLAN is configured on the authenticator switch, it becomes the native VLAN for the
trunk port after successful authentication.
You can enable MDA or multiauth mode on the authenticator switch interface that connects to one more
supplicant switches. Multihost mode is not supported on the authenticator switch interface.
Use the dot1x supplicant force-multicast global configuration command on the supplicant switch for
Network Edge Access Topology (NEAT) to work in all host modes.