User guide

Configuring 802.1X Setting Up Port-Based Network Access Control
OmniSwitch 6600 Family Network Configuration Guide April 2005 page 21-7
Setting Up Port-Based Network Access Control
For port-based network access control, 802.1X must be enabled for the switch and the switch must know
which servers to use for authenticating 802.1X supplicants.
In addition, 802.1X must be enabled on each port that is connected to an 802.1X supplicant (or device).
Optional parameters may be set for each 802.1X port.
The following sections describe these procedures in detail.
Setting 802.1X Switch Parameters
Use the aaa authentication 802.1x command to enable 802.1X for the switch and specify an authentica-
tion server (or servers) to be used for authenticating 802.1X ports. The servers must already be configured
through the aaa radius-server command. An example of specifying authentication servers for authenticat-
ing all 802.1X ports on the switch:
-> aaa authentication 802.1x rad1 rad2
In this example, the rad1 server will be used for authenticating 802.1X ports. If rad1 becomes unavail-
able, the switch will use rad2 for 802.1X authentication. When this command is used, 802.1X is automati-
cally enabled for the switch.
Enabling 802.1X on Ports
To enable 802.1X on a port, use the vlan port 802.1x command. The port must also be configured as a
mobile port.
-> vlan port mobile 3/1
-> vlan port 3/1 802.1x enable
The vlan port 802.1x command enables 802.1X on port 1 of slot 3. The port will be set up with defaults
listed in “802.1X Defaults” on page 21-2.
To disable 802.1X on a port, use the disable option with vlan port 802.1x command. For more informa-
tion about vlan port commands, See Chapter 7, “Assigning Ports to VLANs.”
Configuring 802.1X Port Parameters
By default, when 802.1X is enabled on a port, the port is configured for bidirectional control, automatic
authorization, and re-authentication. In addition, there are several timeout values that are set by default as
well as a maximum number of times the switch will retransmit an authentication request to the user.
All of these parameters may be configured on the same command line but are shown here configured
separately for simplicity.