Cisco Systems 2960 Manual De Usuario
10-13
Catalyst 2960 and 2960-S Switch Software Configuration Guide
OL-8603-09
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
802.1x Host Mode
You can configure an 802.1x port for single-host or for multiple-hosts mode. In single-host mode (see
), only one client can be connected to the 802.1x-enabled switch port. The
switch detects the client by sending an EAPOL frame when the port link state changes to the up state. If
a client leaves or is replaced with another client, the switch changes the port link state to down, and the
port returns to the unauthorized state.
a client leaves or is replaced with another client, the switch changes the port link state to down, and the
port returns to the unauthorized state.
In multiple-hosts mode, you can attach multiple hosts to a single 802.1x-enabled port.
attached clients must be authorized for all clients to be granted network access. If the port becomes
unauthorized (re-authentication fails or an EAPOL-logoff message is received), the switch denies
network access to all of the attached clients. In this topology, the wireless access point is responsible for
authenticating the clients attached to it, and it also acts as a client to the switch.
unauthorized (re-authentication fails or an EAPOL-logoff message is received), the switch denies
network access to all of the attached clients. In this topology, the wireless access point is responsible for
authenticating the clients attached to it, and it also acts as a client to the switch.
With the multiple-hosts mode enabled, you can use 802.1x authentication to authenticate the port and
port security to manage network access for all MAC addresses, including that of the client.
port security to manage network access for all MAC addresses, including that of the client.
Figure 10-5
Multiple Host Mode Example
The switch supports multidomain authentication (MDA), which allows both a data device and a voice
device, such as an IP Phone (Cisco or non-Cisco), to connect to the same switch port. For more
information, see the
device, such as an IP Phone (Cisco or non-Cisco), to connect to the same switch port. For more
information, see the
.
Multidomain Authentication
The switch supports multidomain authentication (MDA), which allows both a data device and voice
device, such as an IP phone (Cisco or non-Cisco), to authenticate on the same switch port. The port is
divided into a data domain and a voice domain.
device, such as an IP phone (Cisco or non-Cisco), to authenticate on the same switch port. The port is
divided into a data domain and a voice domain.
Note
To use MDA, the switch must be running the LAN base image.
MDA does not enforce the order of device authentication. However, for best results, we recommend that
a voice device is authenticated before a data device on an MDA-enabled port.
a voice device is authenticated before a data device on an MDA-enabled port.
Follow these guidelines for configuring MDA:
•
To configure a switch port for MDA, see the
•
You must configure the voice VLAN for the IP phone when the host mode is set to multidomain. For
more information, see
more information, see
101229
Workstations
(clients)
Authentication
server
(RADIUS)