Ieee 802.1X Authentication Configuration Guidelines; Ieee 802.1X Authentication - Cisco 3020 - Catalyst Blade Switch Configuration Manual

Configuring IEEE 802.1x Authentication
Table 7-2
Feature
Authenticator (switch) mode
MAC authentication bypass

IEEE 802.1x Authentication Configuration Guidelines

These section has configuration guidelines for these features:
•
•
•

IEEE 802.1x Authentication

These are the IEEE 802.1x authentication configuration guidelines:
•
•
•
Cisco Catalyst Blade Switch 3020 for HP Software Configuration Guide
7-20
Default IEEE 802.1x Authentication Configuration (continued)
IEEE 802.1x Authentication, page 7-20
VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible Authentication Bypass, page
7-21
MAC Authentication Bypass, page 7-22
When IEEE 802.1x authentication is enabled, ports are authenticated before any other Layer 2
feature is enabled.
If you try to change the mode of an IEEE 802.1x-enabled port (for example, from access to trunk),
an error message appears, and the port mode is not changed.
If the VLAN to which an IEEE 802.1x-enabled port is assigned changes, this change is transparent
and does not affect the switch. For example, this change occurs if a port is assigned to a RADIUS
server-assigned VLAN and is then assigned to a different VLAN after re-authentication.
If the VLAN to which an IEEE 802.1x port is assigned to shut down, disabled, or removed, the port
becomes unauthorized. For example, the port is unauthorized after the access VLAN to which a port
is assigned shuts down or is removed.
– Trunk port—If you try to enable IEEE 802.1x authentication on a trunk port, an error message
appears, and IEEE 802.1x authentication is not enabled. If you try to change the mode of an
IEEE 802.1x-enabled port to trunk, an error message appears, and the port mode is not changed.
– Dynamic ports—A port in dynamic mode can negotiate with its neighbor to become a trunk
port. If you try to enable IEEE 802.1x authentication on a dynamic port, an error message
appears, and IEEE 802.1x authentication is not enabled. If you try to change the mode of an
IEEE 802.1x-enabled port to dynamic, an error message appears, and the port mode is not
changed.
Dynamic-access ports—If you try to enable IEEE 802.1x authentication on a dynamic-access
–
(VLAN Query Protocol [VQP]) port, an error message appears, and IEEE 802.1x authentication
is not enabled. If you try to change an IEEE 802.1x-enabled port to dynamic VLAN assignment,
an error message appears, and the VLAN configuration is not changed.
– EtherChannel port—Do not configure a port that is an active or a not-yet-active member of an
EtherChannel as an IEEE 802.1x port. If you try to enable IEEE 802.1x authentication on an
EtherChannel port, an error message appears, and IEEE 802.1x authentication is not enabled.
Chapter 7 Configuring IEEE 802.1x Port-Based Authentication
Default Setting
None specified.
Disabled.
OL-8915-01