802.1X Authentication With Vlan Assignment - Cisco Catalyst 2960-XR Security Configuration Manual

Configuring IEEE 802.1x Port-Based Authentication
server at the same IP address. If two different host entries on the same RADIUS server are configured for the
same service—for example, authentication—the second host entry configured acts as the fail-over backup to
the first one. The RADIUS host entries are tried in the order that they were configured.
Related Topics
Configuring the Switch-to-RADIUS-Server Communication, on page 255

802.1x Authentication with VLAN Assignment

The switch supports 802.1x authentication with VLAN assignment. After successful 802.1x authentication
of a port, the RADIUS server sends the VLAN assignment to configure the switch port. The RADIUS server
database maintains the username-to-VLAN mappings, assigning the VLAN based on the username of the
client connected to the switch port. You can use this feature to limit network access for certain users.
Voice device authentication is supported with multidomain host mode. When a voice device is authorized
and the RADIUS server returned an authorized VLAN, the voice VLAN on the port is configured to send and
receive packets on the assigned voice VLAN. Voice VLAN assignment behaves the same as data VLAN
assignment on multidomain authentication (MDA)-enabled ports.
When configured on the switch and the RADIUS server, 802.1x authentication with VLAN assignment has
these characteristics:
• If no VLAN is supplied by the RADIUS server or if 802.1x authentication is disabled, the port is
• If 802.1x authentication is enabled but the VLAN information from the RADIUS server is not valid,
• If 802.1x authentication is enabled and all information from the RADIUS server is valid, the authorized
• If the multiple-hosts mode is enabled on an 802.1x port, all hosts are placed in the same VLAN (specified
• Enabling port security does not impact the RADIUS server-assigned VLAN behavior.
• If 802.1x authentication is disabled on the port, it is returned to the configured access VLAN and
When the port is in the force authorized, force unauthorized, unauthorized, or shutdown state, it is put into
the configured access VLAN.
If an 802.1x port is authenticated and put in the RADIUS server-assigned VLAN, any change to the port
access VLAN configuration does not take effect. In the case of a multidomain host, the same applies to voice
devices when the port is fully authorized with these exceptions:
• If the VLAN configuration change of one device results in matching the other device configured or
OL-29434-01
configured in its access VLAN after successful authentication. Recall that an access VLAN is a VLAN
assigned to an access port. All packets sent from or received on this port belong to this VLAN.
authorization fails and configured VLAN remains in use. This prevents ports from appearing unexpectedly
in an inappropriate VLAN because of a configuration error.
Configuration errors could include specifying a VLAN for a routed port, a malformed VLAN ID, a
nonexistent or internal (routed port) VLAN ID, an RSPAN VLAN, a shut down or suspended VLAN.
In the case of a multidomain host port, configuration errors can also be due to an attempted assignment
of a data VLAN that matches the configured or assigned voice VLAN ID (or the reverse).
device is placed in the specified VLAN after authentication.
by the RADIUS server) as the first authenticated host.
configured voice VLAN.
assigned VLAN, authorization of all devices on the port is terminated and multidomain host mode is
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
802.1x Authentication with VLAN Assignment
227