Ieee 802.1X Accounting; Ieee 802.1X Accounting Attribute-Value Pairs - Cisco Catalyst 2950 Software Configuration Manual

Chapter 9 Configuring IEEE 802.1x Port-Based Authentication
•
If the client is successfully authenticated (receives an Accept frame from the authentication server), the
port state changes to authorized, and all frames from the authenticated client are allowed through the
port. If the authentication fails, the port remains in the unauthorized state, but authentication can be
retried. If the authentication server cannot be reached, the switch can resend the request. If no response
is received from the server after the specified number of attempts, authentication fails, and network
access is not granted.
When a client logs off, it sends an EAPOL-logoff message, causing the switch port to transition to the
unauthorized state.
If the link state of a port transitions from up to down, or if an EAPOL-logoff frame is received, the port
returns to the unauthorized state.

IEEE 802.1x Accounting

The IEEE 802.1x standard defines how users are authorized and authenticated for network access but
does not keep track of network usage. IEEE 802.1x accounting is disabled by default. You can enable
IEEE 802.1x accounting to monitor this activity on IEEE 802.1x-enabled ports:
•
•
•
•
•
The switch does not log IEEE 802.1x accounting information. Instead, it sends this information to the
RADIUS server, which must be configured to log accounting messages.

IEEE 802.1x Accounting Attribute-Value Pairs

The information sent to the RADIUS server is represented in the form of Attribute-Value (AV) pairs.
These AV pairs provide data for different applications. (For example, a billing application might require
information that is in the Acct-Input-Octets or the Acct-Output-Octets attributes of a RADIUS packet.)
AV pairs are automatically sent by a switch that is configured for IEEE 802.1x accounting. Three types
of RADIUS accounting packets are sent by a switch:
•
•
•
78-11380-12
auto—enables IEEE 802.1x authentication and causes the port to begin in the unauthorized state,
allowing only EAPOL frames to be sent and received through the port. The authentication process
begins when the link state of the port transitions from down to up or when an EAPOL-start frame is
received. The switch requests the identity of the client and begins relaying authentication messages
between the client and the authentication server. Each client attempting to access the network is
uniquely identified by the switch by using the client's MAC address.
User successfully authenticates.
User logs off.
Link-down occurs.
Re-authentication successfully occurs.
Re-authentication fails.
START–sent when a new user session starts
INTERIM–sent during an existing session for updates
STOP–sent when a session terminates
Understanding IEEE 802.1x Port-Based Authentication
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
9-5