8-35
Configuring Port-Based and Client-Based Access Control (802.1X)
802.1X Open VLAN Mode
■ A client must either have a valid IP address configured before
connecting to the switch, or download one through the Unauthorized-
Client VLAN from a DHCP server. In the latter case, you will need to
provide DHCP services on the Unauthorized-Client VLAN.
■ Ensure that the switch is connected to a RADIUS server configured
to support authentication requests from clients using ports config-
ured as 802.1X authenticators. (The RADIUS server should not be on
the Unauthorized-Client VLAN.)
Note that as an alternative, you can configure the switch to use local
password authentication instead of RADIUS authentication. However,
this is less desirable because it means that all clients use the same
passwords and have the same access privileges. Also, you must use 802.1X
supplicant software that supports the use of local switch passwords.
Caution Ensure that you do not introduce a security risk by allowing Unauthorized-
Client VLAN access to network services or resources that could be compro-
mised by an unauthorized client.
Configuring General 802.1X Operation: These steps enable 802.1X
authentication, and must be done before configuring 802.1X VLAN operation.
1. Enable 802.1X authentication on the individual ports you want to serve
as authenticators. (The switch automatically disables LACP on the ports
on which you enable 802.1X.) On the ports you will use as authenticators
with VLAN operation, ensure that the (default) port-control parameter is
set to auto. (Refer to “1. Enable 802.1X Authentication on Selected Ports”
on page 8-17.) This setting requires a client to support 802.1X authentica-
tion (with 802.1X supplicant operation) and to provide valid credentials
to get network access.
Syntax: aaa port-access authenticator e < port-list > control auto
Activates 802.1X port-access on ports you have configured as
authenticators.
To Next Page
Loading...
Need help?
General