X Readiness Check - Cisco Catalyst 3750-X Software Configuration Manual

Understanding IEEE 802.1x Port-Based Authentication
Table 11-3
Table 11-3
Attribute Number
Attribute[1]
Attribute[4]
Attribute[5]
Attribute[8]
Attribute[25]
Attribute[30]
Attribute[31]
Attribute[40]
Attribute[41]
Attribute[42]
Attribute[43]
Attribute[44]
Attribute[45]
Attribute[46]
Attribute[49]
Attribute[61]
1. The Framed-IP-Address AV pair is sent only if a valid Dynamic Host Control Protocol (DHCP) binding
You can view the AV pairs that are being sent by the switch by entering the debug radius accounting
privileged EXEC command. For more information about this command, see the Cisco IOS Debug
Command Reference, Release 12.2 at this URL:
http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_command_reference_book09186a008
00872ce.html
For more information about AV pairs, see RFC 3580, "IEEE 802.1x Remote Authentication Dial In User
Service (RADIUS) Usage Guidelines."

802.1x Readiness Check

The 802.1x readiness check monitors 802.1x activity on all the switch ports and displays information
about the devices connected to the ports that support 802.1x. You can use this feature to determine if the
devices connected to the switch ports are 802.1x-capable. You use an alternate authentication such as
MAC authentication bypass or web authentication for the devices that do not support 802.1x
functionality.
This feature only works if the supplicant on the client supports a query with the NOTIFY EAP
notification packet. The client must respond within the 802.1x timeout value.
For information on configuring the switch for the 802.1x readiness check, see the
Readiness Check" section on page
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
11-14
lists the AV pairs and when they are sent are sent by the switch:
Accounting AV Pairs
AV Pair Name
User-Name
NAS-IP-Address
NAS-Port
Framed-IP-Address
Class
Called-Station-ID
Calling-Station-ID
Acct-Status-Type
Acct-Delay-Time
Acct-Input-Octets
Acct-Output-Octets
Acct-Session-ID
Acct-Authentic
Acct-Session-Time
Acct-Terminate-Cause
NAS-Port-Type
exists for the host in the DHCP snooping bindings table.
Chapter 11
START INTERIM
Always Always
Always Always
Always Always
Never Sometimes
Always Always
Always Always
Always Always
Always Always
Always Always
Never Always
Never Always
Always Always
Always Always
Never Always
Never Never
Always Always
11-38.
Configuring IEEE 802.1x Port-Based Authentication
STOP
Always
Always
Always
1 1
Sometimes
Always
Always
Always
Always
Always
Always
Always
Always
Always
Always
Always
Always
"Configuring 802.1x
OL-21521-01