Vlan Assignment, Guest Vlan, Restricted Vlan, And Inaccessible Authentication Bypass - Cisco 3750G - Catalyst Integrated Wireless LAN Controller Configuration Manual

Configuring IEEE 802.1x Authentication
•
•
•
•

VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible Authentication Bypass

These are the configuration guidelines for VLAN assignment, guest VLAN, restricted VLAN, and
inaccessible authentication bypass:
•
Catalyst 3750 Switch Software Configuration Guide
10-24
If the VLAN to which an IEEE 802.1x-enabled port is assigned changes, this change is transparent
and does not affect the switch. For example, this change occurs if a port is assigned to a RADIUS
server-assigned VLAN and is then assigned to a different VLAN after re-authentication.
If the VLAN to which an IEEE 802.1x port is assigned to shut down, disabled, or removed, the port
becomes unauthorized. For example, the port is unauthorized after the access VLAN to which a port
is assigned shuts down or is removed.
The IEEE 802.1x protocol is supported on Layer 2 static-access ports, voice VLAN ports, and
Layer 3 routed ports, but it is not supported on these port types:
– Trunk port—If you try to enable IEEE 802.1x authentication on a trunk port, an error message
appears, and IEEE 802.1x authentication is not enabled. If you try to change the mode of an
IEEE 802.1x-enabled port to trunk, an error message appears, and the port mode is not changed.
Dynamic ports—A port in dynamic mode can negotiate with its neighbor to become a trunk
–
port. If you try to enable IEEE 802.1x authentication on a dynamic port, an error message
appears, and IEEE 802.1x authentication is not enabled. If you try to change the mode of an
IEEE 802.1x-enabled port to dynamic, an error message appears, and the port mode is not
changed.
Dynamic-access ports—If you try to enable IEEE 802.1x authentication on a dynamic-access
–
(VLAN Query Protocol [VQP]) port, an error message appears, and IEEE 802.1x authentication
is not enabled. If you try to change an IEEE 802.1x-enabled port to dynamic VLAN assignment,
an error message appears, and the VLAN configuration is not changed.
– EtherChannel port—Do not configure a port that is an active or a not-yet-active member of an
EtherChannel as an IEEE 802.1x port. If you try to enable IEEE 802.1x authentication on an
EtherChannel port, an error message appears, and IEEE 802.1x authentication is not enabled.
Note In software releases earlier than Cisco IOS Release 12.2(18)SE, if IEEE 802.1x
authentication is enabled on a not-yet active port of an EtherChannel, the port does not
join the EtherChannel.
Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) destination ports—You can
–
enable IEEE 802.1x authentication on a port that is a SPAN or RSPAN destination port.
However, IEEE 802.1x authentication is disabled until the port is removed as a SPAN or
RSPAN destination port. You can enable IEEE 802.1x authentication on a SPAN or RSPAN
source port.
Before globally enabling IEEE 802.1x authentication on a switch by entering the dot1x
system-auth-control global configuration command, remove the EtherChannel configuration from
the interfaces on which IEEE 802.1x authentication and EtherChannel are configured.
If you are using a device running the Cisco Access Control Server (ACS) application for
IEEE 802.1x authentication with EAP-Transparent LAN Services (TLS) and EAP-MD5 and your
switch is running Cisco IOS Release 12.1(14)EA1, make sure that the device is running ACS
Version 3.2.1 or later.
When IEEE 802.1x authentication is enabled on a port, you cannot configure a port VLAN that is
equal to a voice VLAN.
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
OL-8550-02