Configuring The Host Mode - Cisco Catalyst 2928 Software Configuration Manual

Chapter 9 Configuring IEEE 802.1x Port-Based Authentication
This example shows how to specify the server with IP address 172.20.39.46 as the RADIUS server, to
use port 1612 as the authorization port, and to set the encryption key to rad123, matching the key on the
RADIUS server:
Switch(config)# radius-server host 172.l20.39.46 auth-port 1612 key rad123
You can globally configure the timeout, retransmission, and encryption key values for all RADIUS
servers by using the radius-server host global configuration command. If you want to configure these
options on a per-server basis, use the radius-server timeout, radius-server retransmit, and the
radius-server key global configuration commands. For more information, see the
for All RADIUS Servers" section on page
You also need to configure some settings on the RADIUS server. These settings include the IP address
of the switch and the key string to be shared by both the server and the switch. For more information,
see the RADIUS server documentation.

Configuring the Host Mode

Beginning in privileged EXEC mode, follow these steps to allow a single host (client) or multiple hosts
on an IEEE 802.1x-authorized port that has the dot1x port-control interface configuration command set
to auto. This procedure is optional.
Command
Step 1 configure terminal
Step 2 radius-server vsa send authentication
Step 3 interface interface-id
Step 4 dot1x host-mode {single-host |
multi-host}
Step 5 switchport voice vlan vlan-id
Step 6 end
Step 7
show dot1x interface interface-id
Step 8 copy running-config startup-config
To disable multiple hosts on the port, use the no dot1x host-mode multi-host interface configuration
command.
This example shows how to enable IEEE 802.1x authentication and to allow multiple hosts:
Switch(config)# interface gigabitethernet/0/1
Switch(config-if)# dot1x port-control auto
Switch(config-if)# dot1x host-mode multi-host
Switch(config-if)# end
OL-23389-01
8-29.
Purpose
Enter global configuration mode.
Configure the network access server to recognize and use vendor-specific
attributes (VSAs).
Specify the port to which multiple hosts are indirectly attached, and enter
interface configuration mode.
The keywords have these meanings:
single-host–Allow a single host (client) on an
•
IEEE 802.1x-authorized port.
multi-host–Allow multiple hosts on an IEEE 802.1x-authorized port
•
after a single host has been authenticated.
Make sure that the dot1x port-control interface configuration command
set is set to auto for the specified interface.
(Optional) Configure the voice VLAN.
Return to privileged EXEC mode.
Verify your entries.
(Optional) Save your entries in the configuration file.
Catalyst 2928 Switch Software Configuration Guide
Configuring IEEE 802.1x Authentication
"Configuring Settings
9-23