Ieee 802.1X Host Mode - Cisco ME 3400 Software Configuration Manual

Understanding IEEE 802.1x Port-Based Authentication
Table 8-1
Attribute number
Attribute[40]
Attribute[41]
Attribute[42]
Attribute[43]
Attribute[44]
Attribute[45]
Attribute[46]
Attribute[49]
You can view the AV pairs that are being sent by the switch by enabling the debug radius accounting
or debug aaa accounting privileged EXEC commands. For more information about these commands,
see the Cisco IOS Debug Command Reference, Release 12.2 at this URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122sup/122debug/
See RFC 3580, "IEEE 802.1X Remote Authentication Dial In User Service (RADIUS) Usage Guidelines,"
for more information about AV pairs.

IEEE 802.1x Host Mode

You can configure an IEEE 802.1x port for single-host or for multiple-hosts mode. In single-host mode
(see
The switch detects the client by sending an EAPOL frame when the port link state changes to the up
state. If a client leaves or is replaced with another client, the switch changes the port link state to down,
and the port returns to the unauthorized state.
In multiple-hosts mode, you can attach multiple hosts to a single IEEE 802.1x-enabled port.
on page 8-7
the attached clients must be authorized for all clients to be granted network access. If the port becomes
unauthorized (re-authentication fails or an EAPOL-logoff message is received), the switch denies
network access to all of the attached clients. In this topology, the wireless access point is responsible for
authenticating the clients attached to it, and it also acts as a client to the switch.
With the multiple-hosts mode enabled, you can use IEEE 802.1x to authenticate the port and port
security to manage network access for all MAC addresses, including that of the client.
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide
8-6
Accounting AV Pairs (continued)
AV pair name
Acct-Status-Type
Acct-Delay-Time
Acct-Input-Octets
Acct-Output-Octets
Acct-Session-ID
Acct-Authentic
Acct-Session-Time
Acct-Terminate-Cause
Figure 8-1 on page 8-2), only one client can be connected to the IEEE 802.1x-enabled switch port.
shows IEEE 802.1x port-based authentication in a wireless LAN. In this mode, only one of
Chapter 8 Configuring IEEE 802.1x Port-Based Authentication
Figure 8-3
OL-9639-07