Using Ieee 802.1X Authentication With Guest Vlan - Cisco IE 3000 Software Configuration Manual

Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
To configure VLAN assignment you need to perform these tasks:
•
•
•
For examples of tunnel attributes, see the
Attributes" section on page

Using IEEE 802.1x Authentication with Guest VLAN

You can configure a guest VLAN for each IEEE 802.1x port on the switch to provide limited services to
clients, such as downloading the IEEE 802.1x client. These clients might be upgrading their system for
IEEE 802.1x authentication, and some hosts, such as Windows 98 systems, might not be
IEEE 802.1x-capable.
When you enable a guest VLAN on an IEEE 802.1x port, the switch assigns clients to a guest VLAN
when the switch does not receive a response to its EAP request/identity frame or when EAPOL packets
are not sent by the client.
The switch maintains the EAPOL packet history. If an EAPOL packet is detected on the interface during
the lifetime of the link, the switch determines that the device connected to that interface is an
IEEE 802.1x-capable supplicant, and the interface does not change to the guest VLAN state. EAPOL
history is cleared if the interface link status goes down. If no EAPOL packet is detected on the interface,
the interface changes to the guest VLAN state.
If devices send EAPOL packets to the switch during the lifetime of the link, the switch no longer allows
clients that fail authentication access to the guest VLAN.
If the switch is trying to authorize an IEEE 802.1x-capable voice device and the AAA server is
unavailable, the authorization attempt fails, but the detection of the EAPOL packet is saved in the
EAPOL history. When the AAA server becomes available, the switch authorizes the voice device.
However, the switch no longer allows other devices access to the guest VLAN. To prevent this situation,
use one of these command sequences:
•
•
If an EAPOL packet is detected after the interface has changed to the guest VLAN, the interface reverts
Note
to an unauthorized state, and IEEE 802.1x authentication restarts.
OL-13018-01
Enable AAA authorization by using the network keyword to allow interface configuration from the
RADIUS server.
Enable IEEE 802.1x authentication. (The VLAN assignment feature is automatically enabled when
you configure IEEE 802.1x authentication on an access port).
Assign vendor-specific tunnel attributes in the RADIUS server. The RADIUS server must return
these attributes to the switch:
– [64] Tunnel-Type = VLAN
– [65] Tunnel-Medium-Type = 802
– [81] Tunnel-Private-Group-ID = VLAN name or VLAN ID
Attribute [64] must contain the value VLAN (type 13). Attribute [65] must contain the value 802
(type 6). Attribute [81] specifies the VLAN name or VLAN ID assigned to the
IEEE 802.1x-authenticated user.
9-29.
Enter the dot1x guest-vlan supplicant global configuration command to allow access to the guest
VLAN.
Enter the shutdown interface configuration command followed by the no shutdown interface
configuration command to restart the port.
Understanding IEEE 802.1x Port-Based Authentication
"Configuring the Switch to Use Vendor-Specific RADIUS
Cisco IE 3000 Switch Software Configuration Guide
10-11