Administrator Guide

312 Authentication, Authorization, and Accounting
3 Configure the DiffServ policy.
console(config)#policy-map con-pol in
console(config-policy-map)#class cl-ssh
console(config-policy-classmap)#drop
console(config-policy-classmap)#exit
console(config-policy-map)#class cl-http
console(config-policy-classmap)#police-simple 1000000 64
conform-action transmit violate-action drop
console(config-policy-classmap)#exit
console(config-policy-map)#exit
4 Enable DiffServ on the switch. (Optional as diffserv is enabled by default.)
console(config)#diffserv
5 Configure information about the external RADIUS server the switch uses
to authenticate clients. The RADIUS server IP address is 10.10.10.10, and
the shared secret is qwerty123.
console(config)#radius-server key qwerty123
console(config)#radius-server host 10.10.10.10
console(Config-auth-radius)#exit
6 Enable 802.1X on the switch.
console(config)#dot1x system-auth-control
7 Create a default authentication login list and use the RADIUS server for
port-based authentication for connected clients.
console(config)#aaa authentication dot1x default radius
8 Enter Interface Configuration mode for ports 1–23 and enable MAC-
based authentication.
console(config)#interface range Gi1/0/1-23
console(config-if)#dot1x port-control mac-based
9 Set the ports to an 802.1Q VLAN. The ports must be in general mode to
enable MAC-based 802.1X authentication. Enable the policy on the ports.
console(config-if)#switchport mode general
console(config-if)#service-policy in con-pol
console(config-if)#exit
console(config)#exit