Configuring Web Authentication - Cisco WS-C2960-24LC-S Software Configuration Manual

Configuring IEEE 802.1x Authentication

Configuring Web Authentication

Beginning in privileged EXEC mode, follow these steps to configure authentication, authorization,
accounting (AAA) and RADIUS on a switch before configuring web authentication. The steps enable
AAA by using RADIUS authentication and enable device tracking.
Command
Step 1 configure terminal
Step 2 aaa new-model
Step 3
aaa authentication login default group
radius
Step 4 aaa authorization auth-proxy default
group radius
Step 5 radius-server host key radius-key
Step 6 radius-server attribute 8
include-in-access-req
Step 7 radius-server vsa send authentication
Step 8 ip device tracking
Step 9 end
This example shows how to enable AAA, use RADIUS authentication and enable device tracking:
Switch(config) configure terminal
Switch(config)# aaa new-model
Switch(config)# aaa authentication login default group radius
Switch(config)# aaa authorization auth-proxy default group radius
Switch(config)# radius-server host 1.1.1.2 key key1
Switch(config)# radius-server attribute 8 include-in-access-req
Switch(config)# radius-server vsa send authentication
Switch(config)# ip device tracking
Switch(config) end
Catalyst 2960 Switch Software Configuration Guide
9-38
Chapter 9
Purpose
Enter global configuration mode.
Enable AAA.
Use RADIUS authentication. Before you can use this authentication
method, you must configure the RADIUS server. For more
information, see Chapter 8, "Configuring Switch-Based
Authentication."
The console prompts you for a username and password on future
attempts to access the switch console after entering the aaa
authentication login command. If you do not want to be prompted for
a username and password, configure a second login authentication
list:
Switch# config t
Switch(config)# aaa authentication login line-console none
Switch(config)# line console 0
Switch(config-line)# login authentication line-console
Switch(config-line)# end
Use RADIUS for authentication-proxy (auth-proxy) authorization.
Specify the authentication and encryption key for RADIUS
communication between the switch and the RADIUS daemon.
Configure the switch to send the Framed-IP-Address RADIUS
attribute (Attribute[8]) in access-request or accounting-request
packets.
Configure the network access server to recognize and use
vendor-specific attributes (VSAs).
Enable the IP device tracking table.
To disable the IP device tracking table, use the no ip device tracking
global configuration commands.
Return to privileged EXEC mode.
Configuring IEEE 802.1x Port-Based Authentication
OL-8603-04