System information

Contents
9 Configuring Port-Based Access Control (802.1x)
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2
Why Use Port-Based Access Control? . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2
General Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2
How 802.1x Operates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-5
Authenticator Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-5
Switch-Port Supplicant Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-6
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-7
General Operating Rules and Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-9
General Setup Procedure for Port-Based Access Control
(802.1x) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-11
Do These Steps Before You Configure 802.1x Operation . . . . . . . . . 9-11
Overview: Configuring 802.1x Authentication on the Switch . . . . . . 9-12
Configuring Switch Ports as 802.1x Authenticators . . . . . . . . . . . . 9-14
802.1x Open VLAN Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-20
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-20
Use Models for 802.1x Open VLAN Modes . . . . . . . . . . . . . . . . . . . . . 9-21
Operating Rules for Authorized-Client and Unauthorized-Client
VLANs
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-24
Setting Up and Configuring 802.1x Open VLAN Mode . . . . . . . . . . . . 9-26
802.1x Open VLAN Operating Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-30
Option For Authenticator Ports: Configure Port-Security
To Allow Only 802.1x Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-31
Configuring Switch Ports To Operate As Supplicants for
802.1x Connections to Other Switches . . . . . . . . . . . . . . . . . . . . . . . . 9-33
Displaying 802.1x Configuration, Statistics, and Counters . . . . . . 9-37
Show Commands for Port-Access Authenticator . . . . . . . . . . . . . . . . 9-37
Viewing 802.1x Open VLAN Mode Status . . . . . . . . . . . . . . . . . . . . . . . 9-39
Show Commands for Port-Access Supplicant . . . . . . . . . . . . . . . . . . . 9-42
How RADIUS/802.1x Authentication Affects VLAN Operation . . 9-43
Messages Related to 802.1x Operation . . . . . . . . . . . . . . . . . . . . . . . . 9-47
viii