10-30
Catalyst 3750 SwitchSoftware Configuration Guide
OL-8550-09
Chapter10 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
If the switch already authorized a port by using MAC authentication bypass and detects an 802.1x
supplicant, the switch does not unauthorize the client connected to the port. When re-authentication
occurs, the switch uses 802.1x authentication as the preferred re-authentication process if the previous
session ended because the Termination-Action RADIUS attribute value is DEFAULT.
Clients that were authorized with MAC authentication bypass can be re-authenticated. The
re-authentication process is the same as that for clients that were authenticated with 802.1x. During
re-authentication, the port remains in the previously assigned VLAN. If re-authentication is successful,
the switch keeps the port in the same VLAN. If re-authentication fails, the switch assigns the port to the
guest VLAN, if one is configured.
If re-authentication is based on the Session-Timeout RADIUS attribute (Attribute[27]) and the
Termination-Action RADIUS attribute (Attribute [29]) and if the Termination-Action RADIUS attribute
(Attribute [29]) action is Initialize, (the attribute value is DEFAULT), the MAC authentication bypass
session ends, and connectivity is lost during re-authentication. If MAC authentication bypass is enabled
and the 802.1x authentication times out, the switch uses the MAC authentication bypass feature to
initiate re-authorization. For more information about these AV pairs, see RFC 3580, “802.1X Remote
Authentication Dial In User Service (RADIUS) Usage Guidelines.”
MAC authentication bypass interacts with the features:
•802.1x authentication—You can enable MAC authentication bypass only if 802.1x authentication is
enabled on the port.
•Guest VLAN—If a client has an invalid MAC address identity, the switch assigns the client to a
guest VLAN if one is configured.
•Restricted VLAN—This feature is not supported when the client connected to an 802.lx port is
authenticated with MAC authentication bypass.
•Port security—See the “802.1x Authentication with Port Security” section on page10-28.
•Voice VLAN—See the “802.1x Authentication with Voice VLAN Ports” section on page 10-27.
•VLAN Membership Policy Server (VMPS)—802.1x and VMPS are mutually exclusive.
•Private VLAN—You can assign a client to a private VLAN.
•Network admission control (NAC) Layer 2 IP validation—This feature takes effect after an802.1x
port is authenticated with MAC authentication bypass, including hosts in the exception list.
For more configuration information, see the “Authentication Manager” section on page10-8.
Cisco IOS Release 12.2(55)SE and later supports filtering of verbose MAB system messages. See the
“Authentication Manager CLI Commands” section on page10-10.