Cisco WS-C2980G-A Software Guide - Page 505

Chapter 31 Configuring 802.1x Authentication Authentication Default Configuration • When an 802.1x-configured module comes up, the server configures all 802.1x ports in NVRAM-configured VLANs. • If you clear an 802.1x-configured module's configuration, all the 802.1x ports are moved to the NVRAM-configured VLAN and all the EARL entries for the 802.1x ports are cleared. • If you move an 802.1x port from an authorized to an unauthorized state, the server moves the port to the NVRAM-configured VLAN. In order for the 802.1x VLAN assignment using a RADIUS server to successfully complete, the RADIUS server must return the following three RFC 2868 attributes back to the authenticator (the Cisco switch to which the host attaches): • [64] Tunnel-Type = VLAN • [65] Tunnel-Medium-Type = 802 • [81] Tunnel-Private-Group-Id = VLAN NAME Attribute [64] must contain the value "VLAN" (type 13). Attribute [65] must contain the value "802" (type 6). Attribute [81] specifies the VLAN name in which the successfully authenticated 802.1x host should be put. Note You must specify the VLAN by its name and not by its number. Authentication Default Configuration Table 31-2 shows the default configuration for authentication. Table 31-2 802.1x Authentication Default Configuration Feature 802.1x port control 802.1x multiple hosts 802.1x system authentication control 802.1x quiet period time 802.1x authenticator to host retransmission time 802.1x back-end authenticator to host retransmission time 802.1x back-end authenticator to authentication server retransmission time 802.1x number of frames retransmitted from back-end authenticator to host 802.1x automatic host reauthentication time 802.1x automatic authenticator reauthentication of host 802.1x shutdown timout period Default Value Force-Authorized Disabled Enable 60 sec 30 sec 30 sec 30 sec 2 frames 3600 sec Disabled 0 seconds 78-15486-01 Catalyst 4500 Series, Catalyst 2948G, Catalyst 2980G Switches Software Configuration Guide-Release 8.1 31-7