Ieee 802.1X Host Mode - Cisco Catalyst 2950 Software Configuration Manual

Understanding IEEE 802.1x Port-Based Authentication
Table 9-1
Table 9-1
Attribute Number
Attribute[1]
Attribute[4]
Attribute[5]
Attribute[8]
Attribute[25]
Attribute[30]
Attribute[31]
Attribute[40]
Attribute[41]
Attribute[42]
Attribute[43]
Attribute[44]
Attribute[45]
Attribute[46]
Attribute[49]
Attribute[61]
1. The Framed-IP-Address AV pair is sent only if a valid Dynamic Host Control Protocol (DHCP) binding
You can view the AV pairs that are being sent by the switch by entering the debug radius accounting
priveliged EXEC command. For more information about this command, see the Cisco IOS Debug Com-
mand Reference, Release 12.2 at this URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122sup/122debug
For more information about AV pairs, see RFC 3580, "IEEE 802.1X Remote Authentication Dial In User
Service (RADIUS) Usage Guidelines."

IEEE 802.1x Host Mode

You can configure an IEEE 802.1x port for single-host or for multiple-hosts mode. In single-host mode
(see
The switch detects the client by sending an EAPOL frame when the port link state changes to the up
state. If a client leaves or is replaced with another client, the switch changes the port link state to down,
and the port returns to the unauthorized state.
In multiple-hosts mode, you can attach multiple hosts to a single IEEE 802.1x-enabled port.
on page 9-7
the attached clients must be authorized for all clients to be granted network access. If the port becomes
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
9-6
lists the AV pairs and when they are sent are sent by the switch:
Accounting AV Pairs
AV Pair Name
User-Name
NAS-IP-Address
NAS-Port
Framed-IP-Address
Class
Called-Station-ID
Calling-Station-ID
Acct-Status-Type
Acct-Delay-Time
Acct-Input-Octets
Acct-Output-Octets
Acct-Session-ID
Acct-Authentic
Acct-Session-Time
Acct-Terminate-Cause
NAS-Port-Type
exists for the host in the DHCP snooping bindings table.
Figure 9-1 on page 9-2), only one client can be connected to the IEEE 802.1x-enabled switch port.
shows IEEE 802.1x port-based authentication in a wireless LAN. In this mode, only one of
Chapter 9 Configuring IEEE 802.1x Port-Based Authentication
START INTERIM
Always Always
Always Always
Always Always
1
Never Sometimes
Always Always
Always Always
Always Always
Always Always
Always Always
Never Never
Never Never
Always Always
Always Always
Never Never
Never Never
Always Always
STOP
Always
Always
Always
1
Sometimes
Always
Always
Always
Always
Always
Always
Always
Always
Always
Always
Always
Always
Figure 9-3
78-11380-12