13-32
Cisco IE 2000 Switch Software Configuration Guide
OL-25866-01
Chapter 13 Configuring IEEE 802.1x Port-Based Authentication
Information About Configuring IEEE 802.1x Port-Based Authentication
Note You must configure the RADIUS server to perform accounting tasks, such as logging start, stop, and
interim-update messages and time stamps. To turn on these functions, enable logging of
“Update/Watchdog packets from this AAA client” in your RADIUS server Network Configuration tab.
Next, enable “CVS RADIUS Accounting” in your RADIUS server System Configuration tab.
802.1x Authentication Guidelines
• When 802.1x authentication is enabled, ports are authenticate d before any other Layer 2 features are
enabled.
• If the VLAN to which an 802.1x-enabled port is assi gned changes, this change is transparent and
does not affect the switch. For example, this change occurs if a p ort is assigned to a RADIUS
server-assigned VLAN and is then assigned to a different VLAN after reauthentication.
If the VLAN to which an 802.1x port is assigned to shut down, disabled, or removed, the port
becomes unauthorized. For example, the port is unauthorized after the access VLA N to which a port
is assigned shuts down or is removed.
• The 802.1x protocol is supported on Layer 2 static-access ports, and voice VLAN ports, but it is not
supported on these port types:
–
Trunk port—If you try to enable 802.1x authentication on a trunk port, an error message
appears, and 802.1x authentication is not enabled. If you try to change the mode of
an 802.1x-enabled port to trunk, an error message appears, and the port mode is not changed.
–
Dynamic ports—A port in dynamic mode can negotiate with its neighbor to become a trunk
port. If you try to enable 802.1x authentication on a dynamic port, an error message appears,
and 802.1x authentication is not enabled. If you try to change the mode of an 802.1x-enabled
port to dynamic, an error message appears, and the port mode is not changed .
–
Dynamic-access ports—If you try to enable 802.1x authentication on a dynamic-access (VLAN
Query Protocol [VQP]) port, an error message appears, and 80 2.1x authentication is not
enabled. If you try to change an 802.1x-enabled port to dynamic VLAN assignment, an error
message appears, and the VLAN configuration is not changed.
–
EtherChannel port—Do not configure a port that is an act ive or a not-yet-active member of an
EtherChannel as an 802.1x port. If you try to enable 802.1x aut hentication on an EtherChannel
port, an error message appears, and 802.1x authentication i s not enabled.
–
Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) destination ports—You can
enable 802.1x authentication on a port that is a SPAN or RSPAN destination port.
However, 802.1x authentication is disabled until the port is removed as a SPAN or RSPAN
destination port. You can enable 802.1x authentication on a SPAN or RSPAN source port.
• Before globally enabling 802.1x authentication on a switch by entering the dot1x
system-auth-control global configuration command, remove the EtherChannel configuration from
the interfaces on which 802.1x authentication and EtherCha nnel are configured.
• System messages related to 802.1x authentication can be filtered. See the “Authentication Manager
CLI Commands” section on page 13-8.