Cisco 3560G 48TS Software Configuration Guide - Page 201

Chapter 9 Configuring 802.1X Port-Based Authentication Understanding 802.1X Port-Based Authentication In a point-to-point configuration (see Figure 9-1 on page 9-2), only one client can be connected to the 802.1X-enabled switch port. The switch detects the client when the port link state changes to the up state. If a client leaves or is replaced with another client, the switch changes the port link state to down, and the port returns to the unauthorized state. Figure 9-3 shows 802.1X port-based authentication in a wireless LAN. The 802.1X port is configured as a multiple-hosts port that becomes authorized as soon as one client is authenticated. When the port is authorized, all other hosts indirectly attached to the port are granted access to the network. If the port becomes unauthorized (re-authentication fails or an EAPOL-logoff message is received), the switch denies access to the network to all of the attached clients. In this topology, the wireless access point is responsible for authenticating the clients attached to it, and the wireless access point acts as a client to the switch. Figure 9-3 Wireless LAN Example Wireless clients Access point Authentication server (RADIUS) 101227 Using 802.1X with Port Security You can configure 802.1X port and port security in either single-host or multiple-hosts mode. (You also must configure port security on the port by using the switchport port-security interface configuration command.) When you enable port security and 802.1X on a port, 802.1X authenticates the port, and port security manages network access for all MAC addresses, including that of the client. You can then limit the number or group of clients that can access the network through an 802.1X port. These are some examples of the interaction between 802.1X and port security on the switch: • When a client is authenticated, and the port security table is not full, the client MAC address is added to the port security list of secure hosts. The port then proceeds to come up normally. When a client is authenticated and manually configured for port security, it is guaranteed an entry in the secure host table (unless port security static aging has been enabled). A security violation occurs if the client is authenticated, but the port security table is full. This can happen if the maximum number of secure hosts has been statically configured or if the client ages out of the secure host table. If the client address is aged, its place in the secure host table can be taken by another host. If the security violation is caused by the first authenticated host, the port becomes error-disabled and immediately shuts down. The port security violation modes determine the action for security violations. For more information, see the "Security Violations" section on page 20-9. 78-16156-01 Catalyst 3560 Switch Software Configuration Guide 9-5