X Supplicant And Authenticator Switches With Network Edge Access Topology (Neat); Guidelines - Cisco Catalyst 3750-X Software Configuration Manual

Chapter 11 Configuring IEEE 802.1x Port-Based Authentication
802.1x Supplicant and Authenticator Switches with Network Edge Access
Topology (NEAT)
The Network Edge Access Topology (NEAT) feature extends identity to areas outside the wiring closet
(such as conference rooms). This allows any type of device to authenticate on the port.
•
•
You can enable MDA or multiauth mode on the authenticator switch interface that connects to one more
supplicant switches. Multihost mode is not supported on the authenticator switch interface.
Use the dot1x supplicant force-multicast global configuration command on the supplicant switch for
Network Edge Access Topology (NEAT) to work in all host modes.
•
•
Figure 11-6
1
1
3
5

Guidelines

•
OL-21521-01
802.1x switch supplicant: You can configure a switch to act as a supplicant to another switch by
using the 802.1x supplicant feature. This configuration is helpful in a scenario, where, for example,
a switch is outside a wiring closet and is connected to an upstream switch through a trunk port. A
switch configured with the 802.1x switch supplicant feature authenticates with the upstream switch
for secure connectivity. Once the supplicant switch authenticates successfully the port mode
changes from access to trunk.
If the access VLAN is configured on the authenticator switch, it becomes the native VLAN for the
trunk port after successful authentication.
Host Authorization: Ensures that only traffic from authorized hosts (connecting to the switch with
supplicant) is allowed on the network. The switches use Client Information Signalling Protocol
(CISP) to send the MAC addresses connecting to the supplicant switch to the authenticator switch,
as shown in Figure 11-6.
Auto enablement: Automatically enables trunk configuration on the authenticator switch, allowing
user traffic from multiple VLANs coming from supplicant switches. Configure the cisco-av-pair as
device-traffic-class=switch at the ACS. (You can configure this under the group or the user settings.)
Authenticator and Supplicant Switch using CISP
Workstations (clients)
Authenticator switch
Trunk port
You can configure NEAT ports with the same configurations as the other authentication ports. When
the supplicant switch authenticates, the port mode is changed from access to trunk based on the
switch vendor-specific attributes (VSAs). (
Understanding IEEE 802.1x Port-Based Authentication
2 3
5
Supplicant switch (outside wiring closet)
2
Access control server (ACS)
4
device-traffic-class=switch).
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
4
11-29