Configuring A Restricted Vlan - Cisco Catalyst 2960 Software Configuration Manual

Chapter 10 Configuring IEEE 802.1x Port-Based Authentication

Configuring a Restricted VLAN

When you configure a restricted VLAN on a switch stack or a switch, clients that are 802.1x-compliant
are moved into the restricted VLAN when the authentication server does not receive a valid username
and password. The switch supports restricted VLANs only in single-host mode.
Beginning in privileged EXEC mode, follow these steps to configure a restricted VLAN. This procedure
is optional.
Command
Step 1 configure terminal
Step 2 interface interface-id
Step 3 switchport mode access
Step 4 authentication port-control auto
Step 5
authentication event fail action
authorize vlan-id
Step 6 end
Step 7
show authentication interface
interface-id
Step 8
copy running-config startup-config
To disable and remove the restricted VLAN, use the no authentication event fail action authorize
vlan-id interface configuration command. The port returns to the unauthorized state.
This example shows how to enable VLAN 2 as an 802.1x restricted VLAN:
Switch(config-if)# authentication event fail action authorize 2
You can configure the maximum number of authentication attempts allowed before a user is assigned to
the restricted VLAN by using the authentication event retry retry count interface configuration
command. The range of allowable authentication attempts is 1 to 3. The default is 3 attempts.
Beginning in privileged EXEC mode, follow these steps to configure the maximum number of allowed
authentication attempts. This procedure is optional.
Command
Step 1 configure terminal
Step 2 interface interface-id
Step 3 switchport mode access
Step 4
authentication port-control auto
OL-26520-01
Purpose
Enter global configuration mode.
Specify the port to be configured, and enter interface configuration mode.
For the supported port types, see the
Configuration Guidelines" section on page
Set the port to access mode.
Enable 802.1x authentication on the port.
Specify an active VLAN as an 802.1x restricted VLAN. The range is
1 to 4094.
You can configure any active VLAN except an RSPAN VLAN or a voice
VLAN as an 802.1x restricted VLAN.
Return to privileged EXEC mode.
(Optional) Verify your entries.
(Optional) Save your entries in the configuration file.
Purpose
Enter global configuration mode.
Specify the port to be configured, and enter interface configuration mode.
For the supported port types, see the
Configuration Guidelines" section on page
Set the port to access mode.
Enable 802.1x authentication on the port.
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
Configuring 802.1x Authentication
"802.1x Authentication
10-38.
"802.1x Authentication
10-38.
10-55