Cisco IE-3000-8TC Software Configuration Manual page 286

Configuring 802.1x Authentication
Command
Step 3
aaa authentication login default group
radius
Step 4
aaa authorization auth-proxy default
group radius
Step 5
radius-server host key radius-key
Step 6
radius-server attribute 8
include-in-access-req
Step 7
radius-server vsa send authentication
Step 8
ip device tracking
Step 9
end
This example shows how to enable AAA, use RADIUS authentication and enable device tracking:
Switch(config) configure terminal
Switch(config)# aaa new-model
Switch(config)# aaa authentication login default group radius
Switch(config)# aaa authorization auth-proxy default group radius
Switch(config)# radius-server host 1.1.1.2 key key1
Switch(config)# radius-server attribute 8 include-in-access-req
Switch(config)# radius-server vsa send authentication
Switch(config)# ip device tracking
Switch(config) end
Cisco IE 3000 Switch Software Configuration Guide
12-56
Chapter 12
Purpose
Use RADIUS authentication. Before you can use this authentication
method, you must configure the RADIUS server. For more
information, see Chapter 11, "Configuring Switch-Based
Authentication."
The console prompts you for a username and password on future
attempts to access the switch console after entering the aaa
authentication login command. If you do not want to be prompted for
a username and password, configure a second login authentication
list:
Switch# config t
Switch(config)# aaa authentication login line-console none
Switch(config)# line console 0
Switch(config-line)# login authentication line-console
Switch(config-line)# end
Use RADIUS for authentication-proxy (auth-proxy) authorization.
Specify the authentication and encryption key for RADIUS
communication between the switch and the RADIUS daemon.
Configure the switch to send the Framed-IP-Address RADIUS
attribute (Attribute[8]) in access-request or accounting-request
packets.
Configure the network access server to recognize and use
vendor-specific attributes (VSAs).
Enable the IP device tracking table.
To disable the IP device tracking table, use the no ip device tracking
global configuration commands.
Return to privileged EXEC mode.
Configuring IEEE 802.1x Port-Based Authentication
OL-13018-03