802.1X Authentication With Inaccessible Authentication Bypass; Inaccessible Authentication Bypass Support On Multiple-Authentication Ports; Inaccessible Authentication Bypass Authentication Results - Cisco Catalyst 2960-XR Security Configuration Manual

802.1x Authentication with Inaccessible Authentication Bypass

connect through a hub. When a client disconnects from the hub, the port might not receive the link down or
EAP logoff event.
After a port moves to the restricted VLAN, a simulated EAP success message is sent to the client. This prevents
clients from indefinitely attempting authentication. Some clients (for example, devices running Windows XP)
cannot implement DHCP without EAP success.
Restricted VLANs are supported on 802.1x ports in all host modes and on Layer 2 ports.
You can configure any active VLAN except an RSPAN VLAN, a primary private VLAN, or a voice VLAN
as an 802.1x restricted VLAN. The restricted VLAN feature is not supported on internal VLANs (routed
ports) or trunk ports; it is supported only on access ports.
Other security port features such as dynamic ARP Inspection, DHCP snooping, and IP source guard can be
configured independently on a restricted VLAN.
802.1x Authentication with Inaccessible Authentication Bypass
Use the inaccessible authentication bypass feature, also referred to as critical authentication or the AAA fail
policy, when the switch cannot reach the configured RADIUS servers and new hosts cannot be authenticated.
You can configure the switch to connect those hosts to critical ports.
When a new host tries to connect to the critical port, that host is moved to a user-specified access VLAN, the
critical VLAN. The administrator gives limited authentication to the hosts.
When the switch tries to authenticate a host connected to a critical port, the switch checks the status of the
configured RADIUS server. If a server is available, the switch can authenticate the host. However, if all the
RADIUS servers are unavailable, the switch grants network access to the host and puts the port in the
critical-authentication state, which is a special case of the authentication state.

Inaccessible Authentication Bypass Support on Multiple-Authentication Ports

When a port is configured on any host mode and the AAA server is unavailable, the port is then configured
to multi-host mode and moved to the critical VLAN. To support this inaccessible bypass on
multiple-authentication (multiauth) ports, use the authentication event server dead action reinitialize vlan
vlan-id command. When a new host tries to connect to the critical port, that port is reinitialized and all the
connected hosts are moved to the user-specified access VLAN.
This command is supported on all host modes.

Inaccessible Authentication Bypass Authentication Results

The behavior of the inaccessible authentication bypass feature depends on the authorization state of the port:
• If the port is unauthorized when a host connected to a critical port tries to authenticate and all servers
• If the port is already authorized and reauthentication occurs, the switch puts the critical port in the
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
234
are unavailable, the switch puts the port in the critical-authentication state in the RADIUS-configured
or user-specified access VLAN.
critical-authentication state in the current VLAN, which might be the one previously assigned by the
RADIUS server.
Configuring IEEE 802.1x Port-Based Authentication
OL-29434-01