Specifications

8-18
Catalyst 2970 Switch Software Configuration Guide
78-15462-03
Chapter8 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Authentication
With the multiple-hosts mode enabled, you can use 802.1X to authenticate the port and port security to
manage network access for all MAC addresses, including that of the client.
Beginning in privileged EXEC mode, follow these steps to allow multiple hosts (clients) on an
802.1X-authorized port that has the dot1x port-control interface configuration command set to auto.
This procedure is optional.
To disable multiple hosts on the port, use the no dot1x host-mode multi-host interface configuration
command.
This example shows how to enable 802.1X on Gigabit Ethernet interface 0/1 and to allow multiple hosts:
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# dot1x port-control auto
Switch(config-if)# dot1x host-mode multi-host
Configuring a Guest VLAN
When you configure a guest VLAN, clients that are not 802.1X-capable are put into the guest VLAN
when the server does not receive a response to its EAPOL request/identity frame. Clients that are
802.1X-capable but fail authentication are not granted access to the network. The switch supports guest
VLANs in single-host or multiple-hosts mode.
Beginning in privileged EXEC mode, follow these steps to configure a guest VLAN. This procedure is
optional.
Command Purpose
Step 1
configure terminal Enter global configuration mode.
Step 2
interface interface-id Enter interface configuration mode, and specify the interface to which
multiple hosts are indirectly attached.
Step 3
dot1x host-mode multi-host Allow multiple hosts (clients) on an 802.1X-authorized port.
Make sure that the dot1x port-control interface configuration command
set is set to auto for the specified interface.
Step 4
end Return to privileged EXEC mode.
Step 5
show dot1x interface interface-id Verify your entries.
Step 6
copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose
Step 1
configure terminal Enter global configuration mode.
Step 2
interface interface-id Enter interface configuration mode, and specify the interface to be
configured. For the supported interface types, see the “802.1X
Configuration Guidelines” section on page 8-11.
Step 3
dot1x guest-vlan vlan-id Specify an active VLAN as an 802.1X guest VLAN. The range is 1 to
4094.
You can configure any active VLAN except an RSPAN VLAN or a voice
VLAN as an 802.1X guest VLAN.
Step 4
end Return to privileged EXEC mode.