Cisco Catalyst 3750-X Command Reference Manual page 62

authentication event
Usage Guidelines Use this command with the fail, no-response, or event keywords to configure the switch response for a
specific action.
For authentication-fail events:
•
•
For no-response events:
•
•
•
Catalyst 3750-X and 3560-X Switch Command Reference
2-30
If the supplicant fails authentication, the port is moved to a restricted VLAN, and an EAP success
message is sent to the supplicant because it i s not notified of the actual authentication failure.
If the EAP success message is not sent, the supplicant tries to authenticate every 60 seconds (the
–
default) by sending an EAP-start message.
Some hosts (for example, devices running Windows XP) cannot implement DHCP until they
–
receive an EAP success message.
The restricted VLAN is supported only in single host mode (the default port mode). When a port is
placed in a restricted VLAN, the supplicant's MAC address is added to the MAC address table. Any
other MAC address on the port is treated as a security violation.
You cannot configure an internal VLANs for Layer 3 ports as a restricted VLAN. You cannot specify
the same VLAN as a restricted VLAN and as a voice VLAN.
Enable re-authentication with restricted VLANs. If re-authentication is disabled, the ports in the
restricted VLANs do not receive re-authentication requests if it is disabled.
To start the re-authentication process, the restricted VLAN must receive a link-down event or an
Extensible Authentication Protocol (EAP) logoff event from the port. If a host is connected through
a hub:
The port might not receive a link-down event when the host is disconnected.
–
The port might not detect new hosts until the next re-authentication attempt occurs.
–
When you reconfigure a restricted VLAN as a different type of VLAN, ports in the restricted VLAN
are also moved and stay in their currently authorized state.
If you enable a guest VLAN on an IEEE 802.1x port, the switch assigns clients to a guest VLAN
when it does not receive a response to its Extensible Authentication Protocol over LAN (EAPOL)
request/identity frame or when EAPOL packets are not sent by the client.
The switch maintains the EAPOL packet history. If another EAPOL packet is detected on the port
during the lifetime of the link, the guest VLAN feature is disabled. If the port is already in the guest
VLAN state, the port returns to the unauthorized state, and authentication restarts. The EAPOL
history is cleared.
If the switch port is moved to the guest VLAN (multi-host mode), multiple non-IEEE
802.1x-capable clients are allowed access . If an IEEE 802.1x-capable client joins the same port on
which the guest VLAN is configured, the port is put in the unauthorized state in the
RADIUS-configured or user-configured access VLAN, and authentication restarts.
You can configure any active VLAN except a Remote Switched Port Analyzer (RSPAN) VLAN, a
primary private VLAN, or a voice VLAN as an IEEE 802.1x guest VLAN. The guest VLAN feature
is supported only on access ports. It is not supported on internal VLANs (routed ports) or trunk
ports.
Chapter 2 Catalyst 3750-X and 3560-X Switch Cisco IOS Commands
OL-29704-01