Cisco WS-C2960-24TC-S Software Guide - Page 184

Understanding IEEE 802.1x Port-Based Authentication Chapter 9 Configuring IEEE 802.1x Port-Based Authentication Figure 9-2 shows the authentication process. Figure 9-2 Authentication Flowchart Start Is the client IEEE 802.1x capable? No IEEE 802.1x authentication process times out. Is MAC authentication bypass enabled? 1 Yes Yes No Start IEEE 802.1x port-based authentication. The switch gets an EAPOL message, and the EAPOL message exchange begins. Use MAC authentication bypass. 1 Client identity is invalid Client identity is valid Client MAC address identity is valid. Client MAC address identity is invalid. Assign the port to a restricted VLAN. Assign the port to a VLAN. Assign the port to Assign the port to a VLAN. a guest VLAN.1 Done Done Done Done 141679 All authentication servers are down. All authentication servers are down. Use inaccessible authentication bypass (critical authentication) to assign the critical port to a VLAN. Done 1 = This occurs if the switch does not detect EAPOL packets from the client. The switch re-authenticates a client when one of these situations occurs: • Periodic re-authentication is enabled, and the re-authentication timer expires. You can configure the re-authentication timer to use a switch-specific value or to be based on values from the RADIUS server. After IEEE 802.1x authentication using a RADIUS server is configured, the switch uses timers based on the Session-Timeout RADIUS attribute (Attribute[27]) and the Termination-Action RADIUS attribute (Attribute [29]). The Session-Timeout RADIUS attribute (Attribute[27]) specifies the time after which re-authentication occurs. Catalyst 2960 Switch Software Configuration Guide 9-4 OL-8603-04