Enabling 802.1X Authentication For Individual Ports; Enabling 802.1X With Inaccessible Authentication Bypass - Cisco WS-C6506 Software Manual

Chapter 40 Configuring 802.1X Authentication

Enabling 802.1X Authentication for Individual Ports

After 802.1X authentication is globally enabled, you must enable 802.1X authentication from the
console for the individual ports. To enable 802.1X authentication globally, see the
Authentication Globally" section on page
You must specify at least one RADIUS server before you can enable 802.1X authentication on the
Note
switch. For more information, see
To enable 802.1X authentication for access to the switch, perform this task in privileged mode:
Task
Step 1
Enable 802.1X control on a specific port.
Step 2 Verify the 802.1X configuration.
This example shows how to enable 802.1X authentication on port 1 in module 3 and verify the
configuration:
Console> (enable) set port dot1x 3/1 port-control auto
Port 3/1 dot1x port-control is set to auto.
Trunking disabled for port 3/1 due to Dot1x feature.
Spantree port fast start option enabled for port 3/1.
Console> (enable) show port dot1x 3/1
Port
----- ------------------- ---------- ------------------- -------------
3/1
Port
----- ------------- -----------------
3/1
Console> (enable)
To clear the current state machines for a new authentication, enter the set port dot1x mod/port initialize
Note
command.

Enabling 802.1X with Inaccessible Authentication Bypass

You can enable 802.1X inaccessible authentication bypass on a per-port basis. This feature allows you to
specify a port as critical. When a port is specified as a critical port, 802.1X attempts to authenticate the
port in the normal way. If attempts to reach the authentication server fail, the port is still given access to
the network in the administratively configured VLAN or the port's native VLAN. You can configure a
port as critical only if it is in single-authentication mode.
After a critical port obtains access to the network, if the authentication server becomes available, the
critical port returns to the unauthorized state, the normal authentication process restarts, and the critical
port moves into the RADIUS server-specified VLAN after the port is authenticated. At this point, you
must initialize the port manually using the set port dot1x mod/port initialize command.
OL-8978-04
Auth-State BEnd-State Port-Control
connecting idle
Port-Mode Re-authentication
SingleAuth disabled
40-14.
Chapter 21, "Configuring the Switch Access Using AAA."
Command
set port dot1x mod/port port-control auto
show port dot1x mod/port
auto
Shutdown-timeout
----------------
disabled
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
Configuring 802.1X Authentication on the Switch
"Enabling 802.1X
Port-Status
unauthorized
Control-Mode
admin oper
---------------
Both Both
40-15