Cisco Systems 2960 Manual De Usuario
10-10
Catalyst 2960 and 2960-S Switch Software Configuration Guide
OL-8603-09
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
Authentication Manager CLI Commands
The authentication-manager interface-configuration commands control all the authentication methods,
such as 802.1x, MAC authentication bypass, and web authentication. The authentication manager
commands determine the priority and order of authentication methods applied to a connected host.
such as 802.1x, MAC authentication bypass, and web authentication. The authentication manager
commands determine the priority and order of authentication methods applied to a connected host.
The authentication manager commands control generic authentication features, such as host-mode,
violation mode, and the authentication timer. Generic authentication commands include the
authentication host-mode, authentication violation, and authentication timer interface
configuration commands.
violation mode, and the authentication timer. Generic authentication commands include the
authentication host-mode, authentication violation, and authentication timer interface
configuration commands.
802.1x-specific commands begin with the dot1x keyword.
For example, the authentication
port-control auto interface configuration command enables authentication on an interface. However,
the dot1x system-authentication control global configuration command only globally enables or
disables 802.1x authentication.
the dot1x system-authentication control global configuration command only globally enables or
disables 802.1x authentication.
Note
If 802.1x authentication is globally disabled, other authentication methods are still enabled on that port,
such as web authentication.
such as web authentication.
The authentication manager commands provide the same functionality as earlier 802.1x commands.
Table 10-2
Authentication Manager Commands and Earlier 802.1x Commands
The authentication manager
commands in Cisco IOS
Release 12.2(50)SE or later
commands in Cisco IOS
Release 12.2(50)SE or later
The equivalent 802.1x commands in
Cisco IOS Release 12.2(46)SE and
earlier
Cisco IOS Release 12.2(46)SE and
earlier
Description
authentication control-direction
{both | in}
{both | in}
dot1x control-direction {both |
in}
in}
Enable authentication with the wake-on-LAN
(WoL) feature, and configure the port control as
unidirectional or bidirectional.
(WoL) feature, and configure the port control as
unidirectional or bidirectional.
authentication event
dot1x auth-fail vlan
dot1x critical (interface
configuration)
configuration)
dot1x guest-vlan6
Enable the restricted VLAN on a port.
Enable the inaccessible-authentication-bypass
feature.
feature.
Specify an active VLAN as an guest VLAN.
authentication fallback
fallback-profile
fallback-profile
dot1x fallback fallback-profile
Configure a port to use web authentication as a
fallback method for clients that do not support
authentication.
fallback method for clients that do not support
authentication.
authentication host-mode
[multi-auth | multi-domain |
multi-host | single-host]
[multi-auth | multi-domain |
multi-host | single-host]
dot1x host-mode {single-host |
multi-host | multi-domain}
multi-host | multi-domain}
Allow a single host (client) or multiple hosts on an
authorized port.
authorized port.
authentication order
dot1x mac-auth-bypass
Provides the flexibility to define the order of
authentication methods to be used.
authentication methods to be used.
authentication periodic
dot1x reauthentication
Enable periodic re-authentication of the client.
authentication port-control {auto
| force-authorized | force-un
authorized}
| force-authorized | force-un
authorized}
dot1x port-control {auto |
force-authorized |
force-unauthorized}
force-authorized |
force-unauthorized}
Enable manual control of the authorization state of
the port.
the port.