Web Authentication With Automatic Mac Check; Configuring Ieee 802.1X Authentication - Cisco WS-C2960-24LC-S Software Configuration Manual

Configuring IEEE 802.1x Authentication

You can configure a port to use only web authentication. You can also configure the port to first try and
use IEEE 802.1x authentication and then to use web authorization if the client does not support
IEEE 802.1x authentication.
Web authentication requires two Cisco Attribute-Value (AV) pair attributes:
•
•
Note
For more information, see the

Web Authentication with Automatic MAC Check

You can use web authentication with automatic MAC check to authenticate a client that does not support
IEEE 802.1x or web browser functionality. This allows end hosts, such as printers, to automatically
authenticate by using the MAC address without any additional required configuration.
Web authentication with automatic MAC check only works in web authentication standalone mode. You
cannot use this if web authentication is configured as a fallback to IEEE 802.1x authentication.
The MAC address of the device must be configured in the Access Control Server (ACS) for the
automatic MAC check to succeed. The automatic MAC check allows managed devices, such as printers,
to skip web authentication.
The interoperability of web authentication (with automatic MAC check) and IEEE 802.1x MAC
Note
authentication configured on different ports of the same switch is not supported.
Configuring IEEE 802.1x Authentication
These sections contain this configuration information:
•
•
•
•
•
•
•
Catalyst 2960 Switch Software Configuration Guide
9-18
The first attribute,
priv-lvl=15
who is logging into the switch.
The second attribute is an access list to be applied for web authenticated hosts. The syntax is similar
to IEEE 802.1X per-user ACLs. However, instead of
, and the
proxyacl source
address replaces the field when the ACL is applied.)
any
For example:
proxyacl# 10=permit ip any 10.0.0.0 255.0.0.0
proxyacl# 20=permit ip any 11.1.0.0 255.255.0.0
proxyacl# 30=permit udp any any eq syslog
proxyacl# 40=permit udp any any eq tftp
The proxyacl entry determines the type of allowed network access.
Default IEEE 802.1x Authentication Configuration, page 9-19
IEEE 802.1x Authentication Configuration Guidelines, page 9-20
Configuring IEEE 802.1x Authentication, page 9-22
Configuring the Switch-to-RADIUS-Server Communication, page 9-24
Configuring the Host Mode, page 9-25
Configuring Periodic Re-Authentication, page 9-25
Manually Re-Authenticating a Client Connected to a Port, page 9-26
Chapter 9
, must always be set to 15. This sets the privilege level of the user
field in each entry must be
"Configuring Web Authentication" section on page
(optional)
(optional)
Configuring IEEE 802.1x Port-Based Authentication
, this attribute must begin with
ip:inacl
. (After authentication, the client IP
any
9-38.
(required)
(required)
(optional)
OL-8603-04