Consolidated Platform Configuration Guide, Cisco Ios Release 15.2(4)E (Catalyst 2960-X Switches - Cisco Catalyst 2960 series Configuration Manual

Command or Action
Step 6 dot1x critical {eapol | recovery delay
milliseconds}
Example:
Switch(config)# dot1x critical eapol
(config)# dot1x critical recovery delay
2000
Step 7 interface interface-id
Example:
Switch(config)# interface
gigabitethernet 1/0/1
Step 8 authentication event server dead action
{authorize | reinitialize} vlan vlan-id]
Example:
Switch(config-if)# authentication event
server dead action
reinitialicze vlan 20
Purpose
• ignore-acct-port—Disable testing on the RADIUS-server accounting
port.
• ignore-auth-port—Disable testing on the RADIUS-server
authentication port.
• For keystring, specify the authentication and encryption key used
between the switch and the RADIUS daemon running on the
RADIUS server. The key is a text string that must match the
encryption key used on the RADIUS server.
Note
You can also configure the authentication and encryption key by using
theradius-server key {0string | 7string | string} global configuration
command.
(Optional) Configure the parameters for inaccessible authentication bypass:
• eapol—Specify that the switch sends an EAPOL-Success message
when the switch successfully authenticates the critical port.
• recovery delaymilliseconds—Set the recovery delay period during
which the switch waits to re-initialize a critical port when a RADIUS
server that was unavailable becomes available. The range is from 1
to 10000 milliseconds. The default is 1000 milliseconds (a port can
be re-initialized every second).
Specify the port to be configured, and enter interface configuration mode.
Use these keywords to move hosts on the port if the RADIUS server is
unreachable:
• authorize—Move any new hosts trying to authenticate to the
user-specified critical VLAN.
• reinitialize—Move all authorized hosts on the port to the
user-specified critical VLAN.

Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)

How to Configure 802.1x Port-Based Authentication
Always configure the key as the last item in the
radius-server host command syntax because leading spaces
are ignored, but spaces within and at the end of the key are
used. If you use spaces in the key, do not enclose the key
in quotation marks unless the quotation marks are part of
the key. This key must match the encryption used on the
RADIUS daemon.
1385