Configuring Port-Based and Client-Based Access Control (802.1X)

Overview

access from a master database in a single server (although you can use up to three RADIUS servers to provide backups in case access to the primary server fails). It also means a user can enter the same username and password pair for authentication, regardless of which switch is the access point into the LAN. Note that you can also configure 802.1X for authentication through the switch’s local username and password instead of a RADIUS server, but doing so increases the administrative burden, decentralizes username/password administration, and reduces security by limiting authentication to one Oper- ator/Manager password set for all users.

Providing a Path for Downloading 802.1X Supplicant Software. For clients that do not have the necessary 802.1X supplicant software, there is also the option to configure the 802.1X Open VLAN mode. This mode allows you to assign such clients to an isolated VLAN through which you can provide the necessary supplicant software these clients need to begin the authentication process. (Refer to “802.1X Open VLAN Mode” on page 8-26.)

Authenticating One Switch to Another. 802.1X authentication also enables the switch to operate as a supplicant when connected to a port on another switch running 802.1X authentication.

Switch Running 802.1X and

Operating as an Authenticator

802.1X-Aware

Client

(Supplicant)

 

 

 

LAN Core

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Switch Running 802.1X and

 

RADIUS Server

 

 

 

 

Connected as a Supplicant

 

 

 

 

 

 

Figure 8-1. Example of an 802.1X Application

Accounting . The switch also provides RADIUS Network accounting for 802.1X access. Refer to “RADIUS Authentication and Accounting” on page 5-1.

8-6