Cisco 500 series Administration Manual page 321

Configuring Security
Configuring 802. 1 X
NOTE
Cisco 500 Series Stackable Managed Switch Administration Guide
In the 802. 1 x standard, a device can be a supplicant and an authenticator at a port
simultaneously, requesting port access and granting port access. However, this
device is only the authenticator, and does not take on the role of a supplicant.
The following varieties of 802. 1 X exist:
• Single session 802.1X:
- Single-session/single host—In this mode, the switch, as an
authenticator, supports a single 802. 1 x session and grants permission to
use the port to the authorized supplicant. All access by other devices
received from the same port are denied until the authorized supplicant is
no longer using the port or the access is to the unauthenticated VLAN or
guest VLAN.
- Single session/multiple hosts—This follows the 802. 1 x standard. In this
mode, the switch as an authenticator allows any device to use a port as
long as it has been granted permission.
• Multi-Session 802.1X—Every device (supplicant) connecting to a port
must be authenticated and authorized by the switch (authenticator)
separately in a different 802. 1 x session.
This is the only mode that supports Dynamic VLAN Assignment (DVA).
NOTE
DVA is only supported on the SG500X model switches when the switch is in Layer
3 system mode.
Dynamic VLAN Assignment (DVA)
Dynamic VLAN Assignment (DVA) is also referred to as RADIUS VLAN Assignment
in this guide. When a port is in Multiple Session mode and is DVA-enabled, the
switch automatically adds the port as an untagged member of the VLAN that is
assigned by the RADIUS server during the authentication process. The switch
classifies untagged packets to the assigned VLAN if the packets originated from
the devices or ports that are authenticated and authorized.
For a device to be authenticated and authorized at a port which is DVA-enabled:
• The RADIUS server must authenticate the device and dynamically assign a
VLAN to the device.
• The assigned VLAN must not be the default VLAN and must have been
created on the switch.
• The switch must not be configured to use both a DVA and a MAC-based
VLAN group together.
18
321