802.1X And Switch Stacks; Configuring 802.1X Authentication - Cisco WS-C3750-48PS-S Software Configuration Manual

Configuring 802.1x Authentication

The maximum size of the per-user ACL is 4000 ASCII characters.
For examples of vendor-specific attributes, see the
RADIUS Attributes" section on page
Chapter 31, "Configuring Network Security with ACLs."
To configure per-user ACLs, you need to perform these tasks:
•
•
•
•
•

802.1x and Switch Stacks

If a switch is added to or removed from a switch stack, 802.1x authentication is not affected as long as
the IP connectivity between the RADIUS server and the stack remains intact. This statement also applies
if the stack master is removed from the switch stack. Note that if the stack master fails, a stack member
becomes the new stack master by using the election process described in
Stacks,"
If IP connectivity to the RADIUS server is interrupted because the switch that was connected to the
server is removed or fails, these events occur:
•
•
If the switch that failed comes up and rejoins the switch stack, the authentications might or might not
fail depending on the boot-up time and whether the connectivity to the RADIUS server is re-established
by the time the authentication is attempted.
To avoid loss of connectivity to the RADIUS server, you should ensure that there is a redundant
connection to it. For example, you can have a redundant connection to the stack master and another to a
stack member, and if the stack master fails, the switch stack still has connectivity to the RADIUS server.
Configuring 802.1x Authentication
These sections describe how to configure 802.1x port-based authentication on your switch:
•
•
•
•
Catalyst 3750 Switch Software Configuration Guide
10-10
Enable AAA authentication.
Enable AAA authorization by using the network keyword to allow interface configuration from the
RADIUS server.
Enable 802.1x.
Configure the user profile and VSAs on the RADIUS server.
Configure the 802.1x port for single-host mode.
and the 802.1x authentication process continues as usual.
Ports that are already authenticated and that do not have periodic re-authentication enabled remain
in the authenticated state. Communication with the RADIUS server is not required.
Ports that are already authenticated and that have periodic re-authentication enabled (with the dot1x
re-authentication global configuration command) fail the authentication process when the
re-authentication occurs. Ports return to the unauthenticated state during the re-authentication
process. Communication with the RADIUS server is required.
For an ongoing authentication, the authentication fails immediately because there is no server
connectivity.
Default 802.1x Configuration, page 10-11
802.1x Configuration Guidelines, page 10-12
Upgrading from a Previous Software Release, page 10-13
Configuring 802.1x Authentication, page 10-13
Chapter 10
"Configuring the Switch to Use Vendor-Specific
9-29. For more information about configuring ACLs, see
(required)
Configuring 802.1x Port-Based Authentication
Chapter 5, "Managing Switch
78-16180-02