Single-Host Mode - Cisco Catalyst 4500 Series Configuration Manual

Chapter 44 Configuring 802.1X Port-Based Authentication
•

Single-Host Mode

You can configure an 802.1X port for single-host or multiple-hosts mode. In single-host mode (see
Figure 44-1 on page
switch detects the client by sending an EAPOL frame when the port link state changes to the up state. If
a client leaves or is replaced with another client, the switch changes the port link state to down, and the
port returns to the unauthorized state.
Multiple-Hosts Mode
In multiple-hosts mode, you can attach multiple hosts to a single 802.1X-enabled port.
page 44-7
attached clients must be authorized for all clients to be granted network access. If the port becomes
unauthorized (reauthentication fails or an EAPOL-logoff message is received), the switch denies
network access to all of the attached clients. In this topology, the wireless access point is responsible for
authenticating the clients attached to it, and it also acts as a client to the switch.
With multiple-hosts mode enabled, you can use 802.1X authentication to authenticate the port and port
security to manage network access for all MAC addresses, including that of the client.
Figure 44-4
Wireless clients
Multidomain Authentication Mode
Beginning with Cisco IOS Release 12.2(37)SG, Catalyst 4500 series switches support Multidomain
Authentication (MDA), which allows an IP phone (Cisco or third-party) and a single host behind the IP
phone to authenticate independently, using 802.1X, MAC authentication bypass (MAB) or (for the host
only) web-based authentication. In this application, multidomain refers to two domains — data and voice
— and only two MAC addresses are allowed per-port. A switch can place the host in the data VLAN and
the IP phone in the voice VLAN, even though they appear on the same switch port. The data VLAN and
the voice VLAN can be specified in the CLI configuration. The devices are identified as either data or
voice depending on the vendor-specific-attributes (VSAs) received from the authentication,
authorization, and accounting (AAA) server. The data and voice VLANs can also be obtained from the
VSAs received from the (AAA) server during authentication.
OL-25340-01
Pre-authentication Open Access, page 44-8
44-3), only one client can be connected to the 802.1X-enabled switch port. The
shows 802.1X port-based authentication in a wireless LAN. In this mode, only one of the
Multiple Host Mode Example
Access point
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
About 802.1X Port-Based Authentication
Figure 44-4 on
Authentication
server
(RADIUS)
44-7