Filter
Top Products
10-54
Catalyst 3560 Switch Software Configuration Guide
OL-8553-06
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Configuring 802.1x Authentication
This example shows how to configure NAC Layer 2 802.1x validation:
Switch# configure terminal
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# dot1x reauthentication
Switch(config-if)# dot1x timeout reauth-period server
Configuring 802.1x Switch Supplicant with NEAT
Configuring this feature requires that one switch (outside a wiring closet) is configured as supplicant and
is connected to an authenticator switch.
Note You cannot enable MDA or multiauth mode on the authenticator switch interface that connects
to one more supplicant switches.
For overview information, see the “802.1x Switch Supplicant with Network Edge Access Topology
(NEAT)” section on page 10-25.
Note The cisco-av-pairs must be configured as device-traffic-class=switch on the ACS, which sets the
interface as a trunk after the supplicant is successfuly authenticated.
Beginning in privileged EXEC mode, follow these steps to configure a switch as an authenticator:
Step 5
dot1x timeout reauth-period {seconds |
server}
Set the number of seconds between re-authentication attempts.
The keywords have these meanings:
• seconds—Sets the number of seconds from 1 to 65535; the default is
3600
seconds.
• server—Sets the number of seconds based on the value of the
Session-Timeout RADIUS attribute (Attribute[27]) and the
Termination-Action RADIUS attribute (Attribute [29]).
This command affects the behavior of the switch only if periodic
re-authentication is enabled.
Step 6
end Return to privileged EXEC mode.
Step 7
show authentication interface
interface-id
or
show dot1x interface interface-id
Verify your 802.1x authentication configuration.
Step 8
copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose
Command Purpose
Step 1
configure terminal Enter global configuration mode.
Step 2
cisp enable Enable CISP.