Cisco WS-C4003 Software Guide - Page 363

Chapter 27 Configuring Switch Access Using AAA Configuring Authentication Traffic Control You can restrict traffic in both directions or just incoming traffic. Authentication Server The frames exchanged between the authenticator and the authentication server are dependent on the authentication mechanism, so they are not defined by the 802.1x standard. You can use other protocols, but we recommend RADIUS for authentication, particularly when the authentication server is located remotely, because RADIUS has extensions that support encapsulation of EAP frames built into it. 802.1x Parameters Configurable on the Switch You can configure these 802.1x parameters on the switch: • Force-Authorized, Force-Unauthorized, or Automatic 802.1x port control • Enable or disable multiple hosts on a specific port • Enable or disable system authentication control • Specify quiet time interval • Specify the authenticator to supplicant retransmission time interval • Specify the backend authenticator to supplicant retransmission time interval • Specify the backend authenticator to authentication server retransmission time interval • Specify the number of frames retransmitted from the backend authenticator to supplicant • Specify the automatic supplicant reauthentication time interval • Enable or disable automatic supplicant reauthentication Configuring Authentication These sections describe how to configure the different authentication methods: • Authentication Default Configuration, page 27-10 • Authentication Configuration Guidelines, page 27-11 • Configuring Login Authentication, page 27-12 • Configuring Local Authentication, page 27-13 • Configuring TACACS+ Authentication, page 27-17 • Configuring RADIUS Authentication, page 27-23 • Configuring Kerberos Authentication, page 27-30 • Configuring 802.1x Authentication, page 27-39 78-12647-02 Software Configuration Guide-Catalyst 4000 Family, Catalyst 2948G, Catalyst 2980G, Releases 6.3 and 6.4 27-9