Configuring and Monitoring IEEE 8021x

Regardless of the EAP in use on the supplicant and authentication server, the 802.1x configuration on the authenticator (that is, the Cisco Catalyst switch) remains the same. Following are the general steps required to configure 802.1x authentication on a Cisco Catalyst switch:

Step 1 Globally enable authentication, authorization, and accounting (AAA) on the Cisco Catalyst switch.

Just as you would enable AAA on a Cisco router, you can enable AAA on a Cisco Catalyst switch by issuing the aaa new-model command in global configuration mode.

Step 2 Enable IEEE 802.1x authentication.

After globally enabling AAA on the switch, you specify how the switch will authenticate a user using 802.1x by defining a method list. The method list, as the name suggests, is a list of one or more authentication methods. Available methods include the following:

• enable performs authentication based on the switch's enable password.

• group radius offloads the authentication process to a list of one or more RADIUS servers.

• line performs authentication based on a line password (such as the console line or a vty line).

• local references a locally configured user database for authentication.

• local-case performs case-sensitive authentication based on the local user database.

• none authenticates the supplicant without referencing any of the client's credentials.

For 802.1x authentication, you probably will use group radius as your preferred method in your method list. Also, instead of creating a custom method list, you could use the default keyword to specify that the list of authentication methods you provide is the default list to use, if a method list is not specified.

The global configuration mode syntax to create an 802.1x authentication method list is aaa authentication dot1x [list-name I default] method.

Step 3 Optionally configure authorization.

The global configuration mode command aaa authorization network (default) group radius can optionally be used to instruct the Cisco Catalyst switch to consult the defined RADIUS server(s) for VLAN assignment or other such requests for network services.

Key Topic

Step 4 Configure the Cisco Catalyst switch to communicate with the authentication server (that is, the RADIUS server).

Table 6-6 describes the commands used to configure the Cisco Catalyst switch to communicate with a RADIUS server.

Table 6-6 Configuring a Cisco Catalyst Switch to Communicate with a RADIUS Server

Command	Description
Switch(config)# radius-server host [host-name 1 IP-address]	Identifies the RADIUS server by hostname or IP address
Switch(config)# radius-server key [string]	Specifies the shared secret key used for authentication and encryption between the switch and RADIUS server
Switch(config)# radius-server vsa send [accounting 1 authentication]	Optionally used to configure a Cisco Catalyst switch to use vendor-specific attributes (VSA)

Step 5 Globally enable IEEE 802.1x on the Cisco Catalyst switch.

The dot1x system-auth-control global configuration mode command enables 802.1x authentication on a Cisco Catalyst switch. If you want to configure your switch to support the previously described guest VLAN feature, issue the dot1x guest-vlan supplicant command in global configuration mode.

Step 6 Configure IEEE 802.1x on an interface.

Table 6-7 describes the commands used to configure 802.1x on an interface.

Table 6-7 Configuring IEEE 802.1x at the Interface Level

Command	Description
Switch(config-if)# switchport mode access	Causes a switch port to act as an access port
Switch(config-if)# dot1x port-control [force-authorized 1 force-unauthorized 1 auto]	Configures the port's 802.1x authentication mode
Switch(config-if)# dot1x hostmode multi-host	Optionally configures 802.1x to operate in multiple-host mode, as opposed to single-host mode
Switch(config-if)# dot1x guest-vlan vlan-id	Optionally identifies the VLAN to be used as an 802.1x guest VLAN
Switch(config-if)# dot1x auth-fail vlan vlan-id	Optionally identifies the VLAN to be used as an 802.1x restricted VLAN

Step 7 Verify and monitor the IEEE 802.1x configuration.

After you complete your 802.1x configuration on a Cisco Catalyst switch, you can use the commands described in Table 6-8 to verify and monitor your configuration.

Table 6-8 Monitoring an IEEE 802.1x Configuration

Related Posts

• Using IEEE 8021x for VLAN Assignment
• Different Types of Switch Ports
• Integration Value Add of 8021X
• Implementing a Cisco IOS Zone Based Firewall
• Configuration Example - Wide Area Networks
• Defending Against Layer 2 Attacks
• How to make Money by Investing in Cryptocurrency
• Study Material For Cisco Students
• Entrepreneurship Guides
• Free Hosting for Your Website
• Search Engine Traffic Guide

Readers' Questions

• sanna-leen

  What is enable ieee 802.1 x authentication?

  4 months ago

  • Reply

IEEE 802.1X authentication is a network security standard that provides an authentication framework for securing wired and wireless LANs (Local Area Networks). It defines the protocol for authenticating devices or users wanting to connect to a network. Enabling IEEE 802.1X authentication allows network devices to validate and authorize users or devices before granting them network access. This authentication process typically involves three entities: the supplicant (user or device seeking network access), the authenticator (network switch or access point), and the authentication server (such as a Remote Authentication Dial-In User Service - RADIUS server). When 802.1X authentication is enabled, the following steps occur:

1. The supplicant (user or device) initiates a connection to the network.
2. The authenticator (switch or access point) requests the identification of the supplicant.
3. The supplicant sends its identity information to the authenticator.
4. The authenticator forwards this information to the authentication server.
5. The authentication server validates the identity of the supplicant by checking the credentials (such as usernames and passwords) against a predefined database or directory.
6. The authentication server sends the result of the authentication process (either successful or unsuccessful) back to the authenticator.
7. If the authentication is successful, the authenticator allows the supplicant to access the network. If the authentication fails, network access is denied.Enabling IEEE 802.
8. 1X authentication helps secure the network by preventing unauthorized access and providing better control over who can connect to the network. It is commonly used in enterprise networks to ensure only authorized users or devices can access sensitive data and resources.

Command	Description
Switch# show dotlx	Displays 802.1x status information
Switch# show dotlx [all | interface-identifier]	Displays port-level 802.1x status information for all interfaces or for a specified interface
Switch# show dotlx statistics interface [interface-identifier]	Displays 802.1x statistical information for all ports or a specified port
Switch# show aaa servers	Displays operation status for the configured RADIUS server(s)

Continue reading here: Additional Forms of Attack

Was this article helpful?

0 -1