Cisco IE-3000-8TC Software Configuration Guide - Page 253

Chapter 12 Configuring IEEE 802.1x Port-Based Authentication Understanding IEEE 802.1x Port-Based Authentication • Restricted VLAN-This feature is not supported when the client connected to an 802.lx port is authenticated with MAC authentication bypass. • Port security-See the "802.1x Authentication with Port Security" section on page 12-20. • Voice VLAN-See the "802.1x Authentication with Voice VLAN Ports" section on page 12-20. • VLAN Membership Policy Server (VMPS)-802.1x and VMPS are mutually exclusive. • Private VLAN-You can assign a client to a private VLAN. For more configuration information, see the "Authentication Manager" section on page 12-7. Network Admission Control Layer 2 802.1x Validation The switch supports the Network Admission Control (NAC) Layer 2 802.1x validation, which checks the antivirus condition or posture of endpoint systems or clients before granting the devices network access. With NAC Layer 2 802.1x validation, you can do these tasks: • Download the Session-Timeout RADIUS attribute (Attribute[27]) and the Termination-Action RADIUS attribute (Attribute[29]) from the authentication server. • Set the number of seconds between re-authentication attempts as the value of the Session-Timeout RADIUS attribute (Attribute[27]) and get an access policy against the client from the RADIUS server. • Set the action to be taken when the switch tries to re-authenticate the client by using the Termination-Action RADIUS attribute (Attribute[29]). If the value is the DEFAULT or is not set, the session ends. If the value is RADIUS-Request, the re-authentication process starts. • View the NAC posture token, which shows the posture of the client, by using the show authentication or show dot1x privileged EXEC command. • Configure secondary private VLANs as guest VLANs. Configuring NAC Layer 2 802.1x validation is similar to configuring 802.1x port-based authentication except that you must configure a posture token on the RADIUS server. For information about configuring NAC Layer 2 802.1x validation, see the "Configuring NAC Layer 2 802.1x Validation" section on page 12-49 and the "Configuring Periodic Re-Authentication" section on page 12-37. For more information about NAC, see the Network Admission Control Software Configuration Guide. For more configuration information, see the "Authentication Manager" section on page 12-7. Flexible Authentication Ordering You can use flexible authentication ordering to configure the order of methods that a port uses to authenticate a new host. MAC authentication bypass and 802.1x can be the primary or secondary authentication methods, and web authentication can be the fallback method if either or both of those authentication attempts fail. For more information see the "Configuring Flexible Authentication Ordering" section on page 12-54. OL-13018-03 Cisco IE 3000 Switch Software Configuration Guide 12-23