8-5
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide
OL-9639-06
Chapter 8 Configuring IEEE 802.1x Port-Based Authentication Understanding IEEE 802.1x Port-Based Authentication
If the client is successfully authenticated (receives an Accept frame from the authentication server), the
port state changes to authorized, and all frames from the authenticated client are allowed through the
port. If the authentication fails, the port remains in the unauthorized state, but authentication can be
retried. If the authentication server cannot be reached, the switch can resend the request. If no response
is received from the server after the specified number of attempts, authentication fails, and network
access is not granted.
When a client logs off, it sends an EAPOL-logoff message, causing the switch port to change to the
unauthorized state.
If the link state of a port changes from up to down, or if an EAPOL-logoff frame is received, the port
returns to the unauthorized state.
IEEE 802.1x Accounting
The IEEE 802.1x standard defines how users are authorized and authenticated for network access but
does not keep track of network usage. IEEE 802.1x accounting is disabled by default. You can enable
IEEE 802.1x accounting to monitor this activity on IEEE 802.1x-enabled ports:
• User successfully authenticates.
• User logs off.
• Link-down occurs.
• Re-authentication successfully occurs.
• Re-authentication fails.
The switch does not log IEEE 802.1x accounting information. Instead, it sends this information to the
RADIUS server, which must be configured to log accounting messages.
IEEE 802.1x Accounting Attribute-Value Pairs
The information sent to the RADIUS server is represented in the form of Attribute-Value (AV) pairs.
These AV pairs provide data for different applications. (For e xample, a billing applicati on might requi re
information that is contained within the Acct-Input-Octets or the Acct-Output-Octets of a packet.)
You do not need to configure AV pairs. These are automatically sent by a switch that is configured for
IEEE 802.1x accounting. Table 8-1 lists the AV pairs that might be sent by the switch:
Tab le 8-1 Accounting AV Pairs
Attribute number AV pair name
Attribute[1] User-Name
Attribute[4] NAS-IP-Address
Attribute[5] NAS-Port
Attribute[6] NAS-Port-Type
Attribute[8] Framed-IP-Address
Attribute[25] Class
Attribute[30] Called-Station-ID
Attribute[31] Calling-Station-ID