Cisco WS-CBS3032-DEL Software Configuration Manual page 253

Chapter 9 Configuring IEEE 802.1x Port-Based Authentication
Figure 9-2 Authentication Flowchart
User does not have a
certificate but the system
previously logged on to
the network using
a computer certificate.
Assign the port to
a guest VLAN. a restricted VLAN.
Done
The switch re-authenticates a client when one of these situations occurs:
•
OL-13270-06
Start
Is the client IEEE
802.1x capable?
Yes
Start IEEE 802.1x port-based
authentication.
Client
identity is
invalid
Assign the port to Assign the port to
a VLAN.
Done
All authentication
servers are down.
Use inaccessible
authentication bypass
(critical authentication)
to assign the critical
port to a VLAN.
Done
Periodic re-authentication is enabled, and the re-authentication timer expires.
You can configure the re-authentication timer to use a switch-specific value or to be based on values
from the RADIUS server.
After 802.1x authentication using a RADIUS server is configured, the switch uses timers based on
the Session-Timeout RADIUS attribute (Attribute[27]) and the Termination-Action RADIUS
attribute (Attribute [29]).
The Session-Timeout RADIUS attribute (Attribute[27]) specifies the time after which
re-authentication occurs.
Cisco Catalyst Blade Switch 3130 and 3032 for Dell Software Configuration Guide
No
IEEE 802.1x authentication
process times out.
The switch gets an
EAPOL message,
and the EAPOL
message
exchange begins.
Client
identity is
valid
Done
Understanding IEEE 802.1x Port-Based Authentication
Is MAC authentication
bypass enabled? 1
Yes
Use MAC authentication
1
bypass.
Client MAC
address
identity
is valid.
Assign the port to
a VLAN.
Done
All authentication
servers are down.
1 = This occurs if the switch does not
detect EAPOL packets from the client.
No
Client MAC
address
identity
is invalid.
Assign the port to
1
a guest VLAN.
Done
9-5