Using Ieee 802.1X Authentication With Guest Vlan - Cisco 3750G - Catalyst Integrated Wireless LAN Controller Configuration Manual

Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication

Using IEEE 802.1x Authentication with Guest VLAN

You can configure a guest VLAN for each IEEE 802.1x port on the switch to provide limited services to
clients, such as downloading the IEEE 802.1x client. These clients might be upgrading their system for
IEEE 802.1x authentication, and some hosts, such as Windows 98 systems, might not be
IEEE 802.1x-capable.
When you enable a guest VLAN on an IEEE 802.1x port, the switch assigns clients to a guest VLAN
when the switch does not receive a response to its EAP request/identity frame or when EAPOL packets
are not sent by the client.
With Cisco IOS Release 12.2(25)SE and later, the switch maintains the EAPOL packet history. If an
EAPOL packet is detected on the interface during the lifetime of the link, the switch determines that the
device connected to that interface is an IEEE 802.1x-capable supplicant, and the interface does not
change to the guest VLAN state. EAPOL history is cleared if the interface link status goes down. If no
EAPOL packet is detected on the interface, the interface changes to the guest VLAN state.
Before Cisco IOS Release 12.2(25)SE, the switch did not maintain the EAPOL packet history and
allowed clients that failed authentication access to the guest VLAN, regardless of whether EAPOL
packets had been detected on the interface. You can enable this behavior by using the dot1x guest-vlan
supplicant global configuration command. However, in Cisco IOS Release 12.2(25)SEE, the dot1x
guest-vlan supplicant global configuration command is no longer supported. Use a restricted VLAN to
allow clients that failed authentication access to the network by entering the dot1x auth-fail vlan vlan-id
interface configuration command.
In Cisco IOS Release 12.2(25)SEE and later, if devices send EAPOL packets to the switch during the
lifetime of the link, the switch no longer allows clients that fail authentication access to the guest VLAN.
If an EAPOL packet is detected after the interface has changed to the guest VLAN, the interface reverts
Note
to an unauthorized state, and IEEE 802.1x authentication restarts.
Any number of IEEE 802.1x-incapable clients are allowed access when the switch port is moved to the
guest VLAN. If an IEEE 802.1x-capable client joins the same port on which the guest VLAN is
configured, the port is put into the unauthorized state in the user-configured access VLAN, and
authentication is restarted.
Guest VLANs are supported on IEEE 802.1x ports in single-host or multiple-hosts mode.
You can configure any active VLAN except an RSPAN VLAN, a private VLAN, or a voice VLAN as an
IEEE 802.1x guest VLAN. The guest VLAN feature is not supported on internal VLANs (routed ports)
or trunk ports; it is supported only on access ports.
The switch supports MAC authentication bypass in Cisco IOS Release 12.2(25)SEE and later. When
MAC authentication bypass is enabled on an IEEE 802.1x port, the switch can authorize clients based
on the client MAC address when IEEE 802.1x authentication times out while waiting for an EAPOL
message exchange. After detecting a client on an IEEE 802.1x port, the switch waits for an Ethernet
packet from the client. The switch sends the authentication server a RADIUS-access/request frame with
a username and password based on the MAC address. If authorization succeeds, the switch grants the
client access to the network. If authorization fails, the switch assigns the port to the guest VLAN if one
is specified. For more information, see the"Using IEEE 802.1x Authentication with MAC
Authentication Bypass" section on page 10-18.
For more information, see the "Configuring a Guest VLAN" section on page 10-34.
Catalyst 3750 Switch Software Configuration Guide
10-13
OL-8550-02