Manually Reauthenticating A Client Connected To A Port - Cisco Catalyst 4500 Series Software Configuration Manual

Configuring 802.1X Port-Based Authentication
Although modified trunk parameters are retained, when the trunk link is down or authentication is cleared, the interface is
•
reconfigured to the following:
– spanning-tree portfast
switchport mode access
–
switchport access vlan access-vlan-id
–
access-vlan-id is derived from the switchport trunk native vlan x command entered on the interface. If you have
Note
modified the trunk native VLAN, the configured native VLAN is used as the access-vlan-id when the port returns
to access mode.
• We recommend using 802.1X authentication mode single-host for NEAT configuration on the interface.
• The cisco-av-pairs must be configured as device-traffic-class=switch on the ACS. This sets the interface as a trunk after
the supplicant is successfully authenticated.
• You should not modify the trunk mode configurations that are based on device-traffic-class either manually or through
features such as AutoSmart Ports. it is because 802.1X configuration is not supported for trunk ports.
To change the host mode and apply a standard port configuration on the authenticator switch port, you can also use
•
AutoSmart ports user-defined macros rather than the switch VSA. Doing this allows you to remove unsupported
configurations on the authenticator switch port and to change the port mode from access to trunk. For details, see
Chapter 22, "Configuring Cisco IOS Auto Smartport Macros."
Configuring only the Auto SmartPorts macro does not identify the end host as a supplicant switch. The switch VSA is
Note
required to identify the supplicant switch. However, when Auto Smartports macro is configured, the internal macro that
reconfigures the port from access to trunk is not executed and the Auto Smartports macro should ensure that the port
reconfigures as a trunk port.

Manually Reauthenticating a Client Connected to a Port

You can manually reauthenticate a client connected to a specific port at any time by entering the
dot1x re-authenticate interface privileged EXEC command. If you want to enable or disable periodic reauthentication, see
the "Enabling Periodic Reauthentication" section on page
This example shows how to manually reauthenticate the client connected to Fast Ethernet port 1/1:
Switch# dot1x re-authenticate interface fastethernet1/1
Starting reauthentication on FastEthernet1/1
Initializing the 802.1X Authentication State
The dot1x initialize command causes the authentication process to be restarted regardless of its current state.
This example shows how to restart the authentication process on Fast Ethernet port 1/1:
Switch# dot1x initialize interface fastethernet1/1
This example shows how to restart the authentication process on all ports of the switch:
Switch# dot1x initialize
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
49-94
Chapter 49
49-81.
Configuring 802.1X Port-Based Authentication