802.1X User Distribution; 802.1X User Distribution Configuration Guidelines; Ieee 802.1X Authentication With Voice Vlan Ports - Cisco Catalyst 2960-XR Security Configuration Manual

802.1x User Distribution

802.1x User Distribution
You can configure 802.1x user distribution to load-balance users with the same group name across multiple
different VLANs.
The VLANs are either supplied by the RADIUS server or configured through the switch CLI under a VLAN
group name.
• Configure the RADIUS server to send more than one VLAN name for a user. The multiple VLAN names
• Configure the RADIUS server to send a VLAN group name for a user. The VLAN group name can be

802.1x User Distribution Configuration Guidelines

• Confirm that at least one VLAN is mapped to the VLAN group.
• You can map more than one VLAN to a VLAN group.
• You can modify the VLAN group by adding or deleting a VLAN.
• When you clear an existing VLAN from the VLAN group name, none of the authenticated ports in the
• If you clear the last VLAN from the VLAN group name, the VLAN group is cleared.
• You can clear a VLAN group even when the active VLANs are mapped to the group. When you clear

IEEE 802.1x Authentication with Voice VLAN Ports

A voice VLAN port is a special access port associated with two VLAN identifiers:
• VVID to carry voice traffic to and from the IP phone. The VVID is used to configure the IP phone
• PVID to carry the data traffic to and from the workstation connected to the switch through the IP phone.
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
236
can be sent as part of the response to the user. The 802.1x user distribution tracks all the users in a
particular VLAN and achieves load balancing by moving the authorized user to the least populated
VLAN.
sent as part of the response to the user. You can search for the selected VLAN group name among the
VLAN group names that you configured by using the switch CLI. If the VLAN group name is found,
the corresponding VLANs under this VLAN group name are searched to find the least populated VLAN.
Load balancing is achieved by moving the corresponding authorized user to that VLAN.
The RADIUS server can send the VLAN information in any combination of VLAN-IDs,
Note
VLAN names, or VLAN groups.
VLAN are cleared, but the mappings are removed from the existing VLAN group.
a VLAN group, none of the ports or users that are in the authenticated state in any VLAN within the
group are cleared, but the VLAN mappings to the VLAN group are cleared.
connected to the port.
The PVID is the native VLAN of the port.
Configuring IEEE 802.1x Port-Based Authentication
OL-29434-01