29-23
Software Configuration Guide—Release 12.2(25)SG
OL-7659-03
Chapter29 Understanding and Conf iguring 802.1X Port-Based Authentication
How to Configure 802.1X
To configure 802.1X with authentication-failed VLAN assignment, follow these steps:
To disable the authentication-failed VLAN feature on a particular port, use the no dot1x auth-fail vlan
interface configuration command.
This example shows how to enable a regular VLAN 40 on Fast Ethernet 4/3 as a authentication failure
VLAN on a static access port:
Switch# configure terminal
Switch(config)# interface gigabitethernet3/1
Switch(config-if)# switchport mode access
Switch(config-if)# dot1x port-control auto
Switch(config-if)# dot1x auth-fail vlan 40
Switch(config-if)# dot1x auth-fail max-attempts 5
Switch(config-if)# end
Switch(config)# end
Switch# show dot1x all
Dot1x Info for interface GigabitEthernet3/1
----------------------------------------------------
PortStatus = AUTHORIZED(AUTH-FAIL-VLAN)
MaxReq = 2
MaxAuthReq = 2
HostMode = Single(AUTH-FAIL-VLAN)
PortControl = Auto
QuietPeriod = 60 Seconds
Re-authentication = Disabled
ReAuthPeriod = 3600 Seconds
ServerTimeout = 30 Seconds
SuppTimeout = 30 Seconds
TxPeriod = 30 Seconds
Guest-Vlan = 6
Switch
Command Purpose
Step1 Switch# configure terminal Enters global configuration mode.
Step2 Switch(config)# interface
interface-id
Enters interface configuration mode and specifies the interface to be
enabled for 802.1X authentication.
Step3 Switch(config-if)# switchport mode
access
or
Switch(config-if)# switchport mode
private-vlan host
Specifies a nontrunking, nontagged single VLAN Layer 2 interface.
Specifies that the ports with a valid private VLAN trunk association become
active host private VLAN trunk ports.
Step4 Switch(config-if)# dot1x
port-control auto
Enables 802.1X authentication on the interface.
For feature interaction information with trunk, dynamic, dynamic-access,
EtherChannel, secure, and SPAN ports, see the “802.1X Configuration
Guidelines” section on page29-15.
Step5 Switch(config-if)# dot1x auth-fail
vlan
vlan-id
Enables authentication-failed VLAN on a particular interface.
Step6 Switch(config-if)# dot1x auth-fail
max-attempts
max-attemtps
Configure a maximum number of attempts before the port i s moved to
authentication-failed VLAN.
Default is 3 attempts.
Step7 Switch(config-if)# end Returns to configuration mode.
Step8 Switch(config)# end Returns to privileged EXEC mode.