• You must configure at least one IP address to run the switch HTTP server. You must also configure routes to reach each host IP address. The HTTP server sends the HTTP login page to the host. • Hosts that are more than one hop away might experience traffic disruption if an STP topology change results in the host traffic arriving on a different port. This occurs because the ARP and DHCP updates might not be sent after a Layer 2 (STP) topology change. • Web-based authentication does not support VLAN assignment as a downloadable-host policy. • Web-based authentication supports IPv6 in Session-aware policy mode.
IPv6 Web-authentication requires at least one IPv6 address configured on the switch and IPv6 Snooping configured on the switchport. • Web-based authentication and Network Edge Access Topology (NEAT) are mutually exclusive. You cannot use web-based authentication when NEAT is enabled on an interface, and you cannot use NEAT when web-based authentication is running on an interface. • Identify the following RADIUS security server settings that will be used while configuring switch-to-RADIUS-server communication:
• Host name • Host IP address • Host name and specific UDP port numbers • IP address and specific UDP port numbers The combination of the IP address and UDP port number creates a unique identifier, that enables RADIUS requests to be sent to multiple UDP ports on a server at the same IP address. If two different host entries on the same RADIUS server are configured for the same service (for example, authentication) the second host entry that is configured functions as the failover backup to the first one. The RADIUS host entries are chosen in the order that they were configured. • When you configure the RADIUS server parameters: • Specify the key string on a separate command line.
• For key string , specify the authentication and encryption key used between the switch and the RADIUS daemon running on the RADIUS server. The key is a text string that must match the encryption key used on the RADIUS server. • When you specify the key string , use spaces within and at the end of the key. If you use spaces in the key, do not enclose the key in quotation marks unless the quotation marks are part of the key. This key must match the encryption used on the RADIUS daemon. • You can globally configure the timeout, retransmission, and encryption key values for all RADIUS servers by using with the radius-server global configuration command.
If you want to configure these options on a per-server basis, use the radius-server timeout , radius-server transmit , and the radius-server key global configuration commands. Note You need to configure some settings on the RADIUS server, including: the switch IP address, the key string to be shared by both the server and the switch, and the downloadable ACL (DACL). For more information, see the RADIUS server documentation. Web-Based Authentication Web-Based Authentication Configuration Guidelines and Restrictions Web-Based Authentication 11