X Host Mode - Cisco 3032 Software Configuration Manual

Chapter 9 Configuring IEEE 802.1x Port-Based Authentication
To avoid loss of connectivity to the RADIUS server, you should ensure that there is a redundant
connection to it. For example, you can have a redundant connection to the stack master and another to a
stack member, and if the stack master fails, the switch stack still has connectivity to the RADIUS server.

802.1x Host Mode

Note The switch is usually not configured in the network configuration shown in
You can configure an 802.1x port for single-host or for multiple-hosts mode. In single-host mode (see
Figure 9-1 on page
detects the client by sending an EAPOL frame when the port link state changes to the up state. If a client
leaves or is replaced with another client, the switch changes the port link state to down, and the port
returns to the unauthorized state.
In multiple-hosts mode, you can attach multiple hosts to a single 802.1x-enabled port.
page 9-13
attached clients must be authorized for all clients to be granted network access. If the port becomes
unauthorized (re-authentication fails or an EAPOL-logoff message is received), the switch denies
network access to all of the attached clients. In this topology, the wireless access point is responsible for
authenticating the clients attached to it, and it also acts as a client to the switch.
With the multiple-hosts mode enabled, you can use 802.1x authentication to authenticate the port and
port security to manage network access for all MAC addresses, including that of the client.
Figure 9-5
Wireless clients
802.1x Multiple Authentication Mode
Multiple-authentication (multiauth) mode allows one client on the voice VLAN and multiple
authenticated clients on the data VLAN. When a hub or access point is connected to an 802.1x-enabled
port, multiple-authentication mode provides enhanced security over multiple-hosts mode by requiring
authentication of each connected client. For non-802.1x devices, you can use MAC authentication
bypass or web authentication as the fallback method for individual host authentications to authenticate
different hosts through by different methods on a single port.
Multiple-authentication mode is limited to eight authentications (hosts) per port.
Note
OL-12247-04
9-3), only one client can be connected to the 802.1x-enabled switch port. The switch
shows 802.1x port-based authentication in a wireless LAN. In this mode, only one of the
Multiple Host Mode Example
Access point
Cisco Catalyst Blade Switch 3130 and 3032 for Dell Software Configuration Guide
Understanding IEEE 802.1x Port-Based Authentication
Figure 9-5.
Authentication
server
(RADIUS)
Figure 9-5 on
9-13