8-7
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide
OL-9639-06
Chapter 8 Configuring IEEE 802.1x Port-Based Authentication Understanding IEEE 802.1x Port-Based Authentication
Figure 8-3 Multiple Host Mode Example
Using 802.1x Readiness Check
The 802.1x readiness check monitors IEEE 802.1x activity on all the switch ports and displays
information about the devices connected to the ports that support IEEE 802.1x. You can use this feature
to determine if the devices connected to the switch ports are IEEE 802.1x-capable. You use an alternate
authentication for the devices that do not support IEEE 802.1x functionality.
This feature only works if the supplicant on the client supports a query with the NOTIFY EAP
notification packet. The client must respond within the IEEE 802.1x timeout value.
For information on configuring the switch for the 802.1x readiness check, see the “Configuring 802.1x
Readiness Check” section on page 8-12.
Using IEEE 802.1x with Port Security
You can configure an IEEE 802.1x port with port security in either single-host or multiple-hosts mode.
(You also must configure port security on the port by using the switchport port-security interface
configuration command.) When you enable port security and IEEE 802.1x on a port, IEEE 802.1x
authenticates the port, and port security manages network access for all MAC addresses, including that
of the client. You can then limit the number or group of clients that can access the network through an
IEEE 802.1x port.
These are some examples of the interaction between IEEE 802.1x and port security on the switch:
• When a client is authenticated, and the port security table is not full, the client MAC address is added
to the port security list of secure hosts. The port then proceeds to come up normally.
When a client is authenticated and manually configured for port security, it is guaranteed an entry
in the secure host table (unless port security static aging has been enabled).
A security violation occurs if the client is authenticated, but the port security table is full. This can
happen if the maximum number of secure hosts has been statically configured or if the client ages
out of the secure host table. If the client address is aged, its place in the secure host table can be
taken by another host.
If the security violation is caused by the first authenticated host, the port becomes error-disabled and
immediately shuts down.
The port security violation modes determine the action for security violations. For more
information, see the “Security Violations” section on page 22-10.
101227
Wireless clients
Access point
Authentication
server
(RADIUS)