Filter
Top Products
9-11
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
OL-10101-02
Chapter 9 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
• When an IEEE 802.1x client logs off, the port changes to an unauthenticated state, and all dynamic
entries in the secure host table are cleared, including the entry for the client. Normal authentication
then takes place.
• If the port is administratively shut down, the port becomes unauthenticated, and all dynamic entries
are removed from the secure host table.
• Port security and a voice VLAN can be configured simultaneously on an IEEE 802.1x port that is in
either single-host or multiple-hosts mode. Port security applies to both the voice VLAN identifier
(VVID) and the port VLAN identifier (PVID).
For more information about enabling port security on your switch, see the “Configuring Port Security”
section on page 21-6.
Using IEEE 802.1x Authentication with Wake-on-LAN
The IEEE 802.1x wake-on-LAN (WoL) feature allows dormant PCs to be powered when the switch
receives a specific Ethernet frame, known as the magic packet. You can use this feature in environments
where administrators need to connect to systems that have been powered down. This feature is also
known as the unidirectional controlled port in the IEEE 802.1x standard.
When a host that uses WoL are attached through an IEEE 802.1x port and the host powers off, the
IEEE
802.1x port becomes unauthorized. The port can only receive and send EAPOL packets, and WoL
magic packets cannot reach the host. When the PC is powered off, it is not authorized, and the switch
port is not opened.
When the switch uses IEEE 802.1x authentication with WoL, the switch forwards traffic to unauthorized
IEEE
802.1x ports, including magic packets. While the port is unauthorized, the switch continues to
block ingress traffic other than EAPOL packets. The host can receive packets but cannot send packets to
other devices in the network.
Note If PortFast is not enabled on the port, the port is forced to the bidirectional state.
When you configure a port as unidirectional by using the dot1x control-direction in interface
configuration command, the port changes to the spanning-tree forwarding state. The port can send
packets to the host but cannot receive packets from the host.
When you configure a port as bidirectional by using the dot1x control-direction both interface
configuration command, the port is access-controlled in both directions. The port does not receive
packets from or send packets to the host.
Network Admission Control Layer 2 IEEE 802.1x Validation
In Cisco IOS Release 12.1(22)EA6 and later, the switch supports the Network Admission Control (NAC)
Layer 2 IEEE 802.1x validation, which checks the antivirus condition or posture of endpoint systems or
clients before granting the devices network access. With NAC Layer 2 IEEE 802.1x validation, you can
do these tasks:
• Download the Session-Timeout RADIUS attribute (Attribute[27]) and the Termination-Action
RADIUS attribute (Attribute[29]) from the authentication server.
• Set the number of seconds between re-authentication attempts as the value of the Session-Timeout
RADIUS attribute (Attribute[27]) and get an access policy against the client from the RADIUS
server.