Configuring 802.1X With Guest Vlans - Cisco 4500M Software Manual

Chapter 31 Understanding and Configuring 802.1X Port-Based Authentication
This example shows how to configure 802.1X accounting. The first command configures the RADIUS
server, specifying 1813 as the UDP port for accounting:
Switch(config)# radius-server host 172.120.39.46 auth-port 1812 acct-port 1813 key rad123
Switch(config)# aaa accounting dot1x default start-stop group radius
Switch(config)# aaa accounting system default start-stop group radius
You must configure the RADIUS server to perform accounting tasks, such as logging start, stop, and
Note
interim-update messages and time stamps. To turn on these functions, enable logging of
"Update/Watchdog packets from this AAA client" in your RADIUS server Network Configuration tab.
Next, enable "CVS RADIUS Accounting" in your RADIUS server System Configuration tab.

Configuring 802.1X with Guest VLANs

Note When a port is put into a guest VLAN, it is automatically placed into multihost mode, and an unlimited
number of hosts can connect through the port. Changing the multihost configuration does not effect a
port in a guest VLAN.
To configure 802.1X with guest-VLAN, perform this task:
Command
Step 1
Switch # configure terminal
Step 2
Switch(config)# interface
interface-id
Step 3
Switch(config-if)# dot1x
port-control auto
Step 4
Switch(config-if)# dot1x guest-vlan
vlan-id
Step 5
Switch(config-if)# end
Step 6
Switch(config)# end
To disable the guest VLAN feature on a particular port, use the no dot1x guest-vlan interface
configuration command.
This example shows how to enable a guest VLAN on Fast Ethernet interface 4/3:
Switch# configure terminal
Switch(config)# interface fastethernet4/3
Switch(config-if)# dot1x port-control auto
Switch(config-if)# dot1x guest-vlan 50
Switch(config-if)# end
Switch(config)# end
Switch#
OL-6696-01
Purpose
Enters global configuration mode.
Enters interface configuration mode and specifies the interface to be
enabled for 802.1X authentication.
Enables 802.1X authentication on the interface.
]
For feature interaction information with trunk, dynamic, dynamic-access,
EtherChannel, secure, and SPAN ports, see the
Guidelines" section on page
Enables a guest VLAN on a particular interface.
Returns to configuration mode.
Returns to privileged EXEC mode.
31-13.
Software Configuration Guide—Release 12.2(25)EW
How to Configure 802.1X
"802.1X Configuration
31-17