29-21
Software Configuration Guide—Release 12.2(25)SG
OL-7659-03
Chapter29 Understanding and Conf iguring 802.1X Port-Based Authentication
How to Configure 802.1X
Note When a port is put into a guest VLAN, it is automatically placed into multihost mode, and an unlimited
number of hosts can connect through the port. Changing the multihost configuration does not effect a
port in a guest VLAN.
Except for an RSPAN VLAN or a voice VLAN, you can configure any active VLAN as an 802.1X guest
VLAN. The guest VLAN feature is not supported on trunk ports; it is supported only on access ports.
To configure 802.1X with guest VLAN, perform this task:
To disable the guest VLAN feature on a particular port, use the no dot1x guest-vlan interface
configuration command.
This example shows how to enable a regular VLAN 50 on Fast Ethernet 4/3 as a guest VLA N on a static
access port:
Switch# configure terminal
Switch(config)# interface fa4/3
Switch(config-if)# switchport mode access
Switch(config-if)# dot1x port-control auto
Switch(config-if)# dot1x guest-vlan 50
Switch(config-if)# end
Switch#
This example shows how to enable a secondary private VLAN 100 as a guest VLAN on a private VLAN
host port:
Switch# configure terminal
Switch(config)# interface fa4/3
Switch(config-if)# switchport mode private-vlan host
Switch(config-if)# dot1x port-control auto
Switch(config-if)# dot1x guest-vlan 100
Switch(config-if)# end
Switch#
Command Purpose
Step1 Switch# configure terminal Enters global configuration mode.
Step2 Switch(config)# interface
interface-id
Enters interface configuration mode and specifies the interface to be
enabled for 802.1X authentication.
Step3 Switch(config-if)# switchport mode
access
or
Switch(config-if)# switchport mode
private-vlan host
Specifies a nontrunking, nontagged single VLAN Layer 2 interface.
Specifies that the ports with a valid PVLAN trunk association become active
host private VLAN trunk ports.
Step4 Switch(config-if)# dot1x
port-control auto
Enables 802.1X authentication on the interface.
For feature interaction information with trunk, dynamic, dynamic-access,
EtherChannel, secure, and SPAN ports, see the “802.1X Configuration
Guidelines” section on page29-15.
Step5 Switch(config-if)# dot1x guest-vlan
vlan-id
Enables a guest VLAN on a particular interface.
Step6 Switch(config-if)# end Returns to configuration mode.
Step7 Switch(config)# end Returns to privileged EXEC mode.