Cisco Configuring IEEE 802.1x Port-Based Authentication: Руководство по настройке и сервисной документации (EN)

Restrictions for IEEE 802.1x Port-Based Authentication

Configuring IEEE 802.1x Port-Based Authentication This chapter describes how to configure IEEE 802.1x port-based authentication. IEEE 802.1x authentication prevents unauthorized devices (clients) from gaining access to the network. Unless otherwise noted, the term switch refers to a standalone switch or a switch stack.

Restrictions for IEEE 802.1x Port-Based Authentication, on page 1 Information About IEEE 802.1x Port-Based Authentication, on page 2 How to Configure IEEE 802.1x Port-Based Authentication, on page 35 Configuration Examples for IEEE 802.1x Port-Based Authentication, on page 80 Monitoring IEEE 802.1x Port-Based Authentication Statistics and Status, on page 81 Feature History for IEEE 802.1x Port-Based Authentication, on page 82 Restrictions for IEEE 802.1x Port-Based Authentication The following restrictions apply to IEEE 802.1X port-based authentication. • Switchports are always unauthorized when used with private VLANs.

Dynamic VLANs pushed from the Authentication, Authorization, and Accounting (AAA) server is not supported on private VLAN ports. The data client session is expected to authorize on the secondary VLAN of the private VLAN dot1x port. • Only interface-configured private VLAN-based authorization and dynamic VLAN on a normal access VLAN port is supported. • If the dot1q tag vlan native command is configured globally, the dot1x reauthentication will fail on trunk ports. • Do not configure the same VLAN ID for both voice VLAN and access VLAN at the same time, because it may cause authentication failures. • In certain scenarios, the management VRF cannot be used as the source interface for RADIUS.

In such cases, use one of the forwarding interfaces as the source interface for RADIUS. • If a downloadable ACL contains any type of duplicate entries, the entries are not auto merged. As a result, the 802.1X session authorization fails. Ensure that the downloadable ACL is optimized without any duplicate entries, for example port-based and name-based entries for the same port. • Port security is not supported with IEEE 802.1x port-based authentication. Configuring IEEE 802.1x Port-Based Authentication 1

Стр. 1

Overview of IEEE 802.1x Port-Based Authentication

• If you overwrite the running configuration of interfaces with a configuration file loaded in flash, some ports may fail to authenticate the endpoints. • Reauthentication using SNMP MIB is not supported for 802.1x and MAC authentication bypass (MAB) authentication. Information About IEEE 802.1x Port-Based Authentication The 802.1x standard defines a client-server-based access control and authentication protocol that prevents unauthorized clients from connecting to a LAN through publicly accessible ports unless they are properly authenticated. The authentication server authenticates each client connected to a switch port before making available any services offered by the switch or the LAN.

TACACS is not supported with 802.1x authentication. Note Until the client is authenticated, 802.1x access control allows only Extensible Authentication Protocol over LAN (EAPOL), Cisco Discovery Protocol, and Spanning Tree Protocol (STP) traffic through the port to which the client is connected. After authentication is successful, normal traffic can pass through the port. The table shown below lists the maximum number of session each client supports:

Overview of IEEE 802.1x Port-Based Authentication The 802.1x standard defines a client-server-based access control and authentication protocol that prevents unauthorized clients from connecting to a LAN through publicly accessible ports unless they are properly authenticated. The authentication server authenticates each client connected to a switch port before making available any services offered by the switch or the LAN. TACACS is not supported with 802.1x authentication.

Note Configuring IEEE 802.1x Port-Based Authentication Information About IEEE 802.1x Port-Based Authentication Client session Maximum sessions supported Maximum dot1x or MAB client sessions 2000 Maximum web-based authentication sessions 2000 Maximum dot1x sessions with critical-auth VLAN enabled and server re-initialized 2000 Maximum MAB sessions with various session features applied 2000 Maximum dot1x sessions with service templates or session features applied 2000 Configuring IEEE 802.1x Port-Based Authentication 2

Стр. 2

Port-Based Authentication Process

Until the client is authenticated, 802.1x access control allows only Extensible Authentication Protocol over LAN (EAPOL), Cisco Discovery Protocol, and Spanning Tree Protocol (STP) traffic through the port to which the client is connected. After authentication is successful, normal traffic can pass through the port. Port-Based Authentication Process To configure IEEE 802.1X port-based authentication, you must enable authentication, authorization, and accounting (AAA) and specify the authentication method list. A method list describes the sequence and authentication method to be queried to authenticate a user. The AAA process begins with authentication.

When 802.1x port-based authentication is enabled and the client supports 802.1x-compliant client software, these events occur: • If the client identity is valid and the 802.1x authentication succeeds, the switch grants the client access to the network. • If 802.1x authentication times out while waiting for an EAPOL message exchange and MAC authentication bypass is enabled, the switch can use the client MAC address for authorization. If the client MAC address is valid and the authorization succeeds, the switch grants the client access to the network.

If the client MAC address is invalid and the authorization fails, the switch assigns the client to a guest VLAN that provides limited services if a guest VLAN is configured. • If the switch gets an invalid identity from an 802.1x-capable client and a restricted VLAN is specified, the switch can assign the client to a restricted VLAN that provides limited services. • If the RADIUS authentication server is unavailable (down) and inaccessible authentication bypass is enabled, the switch grants the client access to the network by putting the port in the critical-authentication state in the RADIUS-configured or the user-specified access VLAN.

Inaccessible authentication bypass is also referred to as critical authentication or the AAA fail policy. Note If Multi Domain Authentication (MDA) is enabled on a port, this flow can be used with some exceptions that are applicable to voice authorization. Configuring IEEE 802.1x Port-Based Authentication Port-Based Authentication Process Configuring IEEE 802.1x Port-Based Authentication 3

Стр. 3

Port-Based Authentication Process

Figure 1: Authentication Flowchart This figure shows the authentication process. The switch reauthenticates a client when one of these situations occurs: • Periodic reauthentication is enabled, and the reauthentication timer expires. You can configure the reauthentication timer to use a switch-specific value or to be based on values from the RADIUS server. After 802.1x authentication using a RADIUS server is configured, the switch uses timers based on the Session-Timeout RADIUS attribute (Attribute[27]) and the Termination-Action RADIUS attribute (Attribute [29]). The Session-Timeout RADIUS attribute (Attribute[27]) specifies the time after which reauthentication occurs.

The range is 1 to 1073741823 seconds. Note In releases prior to Cisco IOS XE Bengaluru 17.5.1, the supported timeout range is 1to 65535. seconds. While downgrading from or releases after Cisco IOS XE Bengaluru 17.5.1 set the timeout to supported values to avoid ISSD breakage. seconds. While downgrading from or releases after Cisco IOS XE Bengaluru 17.5.1 set the timeout to supported values to avoid ISSD breakage. Configuring IEEE 802.1x Port-Based Authentication Port-Based Authentication Process Configuring IEEE 802.1x Port-Based Authentication 4

Стр. 4