Port-Based Authentication And Switch Stacks; 802.1X Host Mode - Cisco Catalyst 2960-XR Security Configuration Manual

Port-Based Authentication and Switch Stacks

Port-Based Authentication and Switch Stacks
If a switch is added to or removed from a switch stack, 802.1x authentication is not affected as long as the IP
connectivity between the RADIUS server and the stack remains intact. This statement also applies if the stack
master is removed from the switch stack. Note that if the stack master fails, a stack member becomes the new
stack master by using the election process, and the 802.1x authentication process continues as usual.
If IP connectivity to the RADIUS server is interrupted because the switch that was connected to the server is
removed or fails, these events occur:
• Ports that are already authenticated and that do not have periodic re-authentication enabled remain in
• Ports that are already authenticated and that have periodic re-authentication enabled (with the
If the switch that failed comes up and rejoins the switch stack, the authentications might or might not fail
depending on the boot-up time and whether the connectivity to the RADIUS server is re-established by the
time the authentication is attempted.
To avoid loss of connectivity to the RADIUS server, you should ensure that there is a redundant connection
to it. For example, you can have a redundant connection to the stack master and another to a stack member,
and if the stack master fails, the switch stack still has connectivity to the RADIUS server.

802.1x Host Mode

You can configure an 802.1x port for single-host or for multiple-hosts mode. In single-host mode, only one
client can be connected to the 802.1x-enabled switch port. The switch detects the client by sending an EAPOL
frame when the port link state changes to the up state. If a client leaves or is replaced with another client, the
switch changes the port link state to down, and the port returns to the unauthorized state.
In multiple-hosts mode, you can attach multiple hosts to a single 802.1x-enabled port. In this mode, only one
of the attached clients must be authorized for all clients to be granted network access. If the port becomes
unauthorized (re-authentication fails or an EAPOL-logoff message is received), the switch denies network
access to all of the attached clients. In this topology, the wireless access point is responsible for authenticating
the clients attached to it, and it also acts as a client to the switch.
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
222
the authenticated state. Communication with the RADIUS server is not required.
authentication periodic global configuration command) fail the authentication process when the
re-authentication occurs. Ports return to the unauthenticated state during the re-authentication process.
Communication with the RADIUS server is required.
For an ongoing authentication, the authentication fails immediately because there is no server connectivity.
Configuring IEEE 802.1x Port-Based Authentication
OL-29434-01