802.1X

IEEE 802.1X is an IEEE standard for port-based network access control (PNAC). This standard provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. IEEE 802.1X defines the encapsulation of the Extensible Authentication Protocol (EAP) over IEEE 802, which is known as EAP over LAN (EAPOL).

NOTE Port security is a feature of “edge” switches such as 63/6400, and it is not available on 83xx.

Configuration commands

(switch(config)#) Enter 802.1X authenticator context:

aaa authentication port-access dot1x authenticator

(switch(config-dot1x-auth)#) Enable 802.1X authentication:

enable

(switch(config-dot1x-auth)#) Configure 802.1X authentication method:

chap-radius|eap-radius

(switch(config-dot1x-auth)#) Configure RADIUS server group for 802.1X:

radius server-group NAME

(switch(config-if)#) Enter 802.1X authenticator context on a port:

aaa authentication port-access dot1x
authenticator

(switch(config-if-dot1x-auth)#) Enable 802.1X authentication on a port:

enable

(switch(config-if-dot1x-auth)#) Enable cached re-authentication on a port:

cached-reauth

(switch(config-if-dot1x-auth)#) Configure cached re-authentication period on a port:

cached-reauth-period VALUE

(switch(config-if-dot1x-auth)#) Configure maximum authentication attempts on a port:

max-retries VALUE

(switch(config-if-dot1x-auth)#) Configure quiet period on a port:

quiet-period VALUE

(switch(config-if-dot1x-auth)#) Enable periodic re-authentication on a port:

reauth

(switch(config-if-dot1x-auth)#) Configure re-authentication period on a port:

reauth-period VALUE

(switch(config-if-dot1x-auth)#) Configure discovery period on a port:

discovery-period VALUE

(switch(config-if-dot1x-auth)#) Configure EAPOL timeout on a port:

eapol-timeout VALUE

(switch(config-if-dot1x-auth)#) Configure maximum EAPOL requests on a port:

max-eapol-requests VALUE

(switch(config-if-dot1x-auth)#) Configure force authorized on a port:

authorized

Show commands to validate functionality

(switch(config)#)

show aaa authentication port-access dot1x authenticator interface <IFACE|all> <port-statistics|client-status> [mac MAC-ADDR]

Expected results

  • Administrators can enable dot1x authentication.
  • Administrators are able to authenticate using the specified dot1x authentication method.
  • The output of the show commands looks correct.

Back to Index