Mac Authentication Bypass; Maximum Number Of Allowed Devices Per Port - Cisco WS-CBS3032-DEL Software Configuration Manual

Chapter 9 Configuring IEEE 802.1x Port-Based Authentication
•
•
•

MAC Authentication Bypass

These are the MAC authentication bypass configuration guidelines:
•
•
•
•

Maximum Number of Allowed Devices Per Port

This is the maximum number of devices allowed on an 802.1x-enabled port:
•
•
•
OL-13270-06
After you configure a guest VLAN for an 802.1x port to which a DHCP client is connected, you
might need to get a host IP address from a DHCP server. You can change the settings for restarting
the 802.1x authentication process on the switch before the DHCP process on the client times out and
tries to get a host IP address from the DHCP server. Decrease the settings for the 802.1x
authentication process (authentication timer inactivity and authentication timer
reauthentication interface configuration commands). The amount to decrease the settings depends
on the connected 802.1x client type.
When configuring the inaccessible authentication bypass feature, follow these guidelines:
The feature is supported on 802.1x port in single-host mode and multihosts mode.
–
If the client is running Windows XP and the port to which the client is connected is in the
–
critical-authentication state, Windows XP might report that the interface is not authenticated.
If the Windows XP client is configured for DHCP and has an IP address from the DHCP server,
–
receiving an EAP-Success message on a critical port might not re-initiate the DHCP
configuration process.
– You can configure the inaccessible authentication bypass feature and the restricted VLAN on
an 802.1x port. If the switch tries to re-authenticate a critical port in a restricted VLAN and all
the RADIUS servers are unavailable, switch changes the port state to the critical authentication
state and remains in the restricted VLAN.
You can configure any VLAN except an RSPAN VLAN or a voice VLAN as an 802.1x restricted
VLAN. The restricted VLAN feature is not supported on internal VLANs (routed ports) or trunk
ports; it is supported only on access ports.
Unless otherwise stated, the MAC authentication bypass guidelines are the same as the 802.1x
authentication guidelines. For more information, see the
page 9-35.
If you disable MAC authentication bypass from a port after the port has been authorized with its
MAC address, the port state is not affected.
If the port is in the unauthorized state and the client MAC address is not the authentication-server
database, the port remains in the unauthorized state. However, if the client MAC address is added to
the database, the switch can use MAC authentication bypass to re-authorize the port.
If the port is in the authorized state, the port remains in this state until re-authorization occurs.
In single-host mode, only one device is allowed on the access VLAN. If the port is also configured with
a voice VLAN, an unlimited number of Cisco IP phones can send and receive traffic through the voice
VLAN.
In multidomain authentication (MDA) mode, one device is allowed for the access VLAN, and one
IP phone is allowed for the voice VLAN.
In multihost mode, only one 802.1x supplicant is allowed on the port, but an unlimited number of
non-802.1x hosts are allowed on the access VLAN. An unlimited number of devices are allowed on
the voice VLAN.
Cisco Catalyst Blade Switch 3130 and 3032 for Dell Software Configuration Guide
Configuring 802.1x Authentication
"802.1x Authentication" section on
9-37