Configuring The Host Mode - Cisco 3750G - Catalyst Integrated Wireless LAN Controller Configuration Manual

Chapter 10 Configuring IEEE 802.1x Port-Based Authentication

Configuring the Host Mode

Beginning in privileged EXEC mode, follow these steps to allow a single host (client) on an
IEEE 802.1x-authorized port. Use the multi-domain keyword to configure multidomain authentication
(MDA) to enable authentication of both a host and a voice device, such as an IP phone (Cisco or
non-Cisco) on the same switch port. This procedure is optional.
Command
Step 1 configure terminal
Step 2
radius-server vsa send authentication
Step 3
interface interface-id
Step 4 dot1x host-mode {single-host |
multi-host | multi-domain}
Step 5 switchport voice vlan vlan-id
Step 6 end
Step 7
show dot1x interface interface-id
Step 8 copy running-config startup-config
To disable multiple hosts on the port, use the no dot1x host-mode multi-host interface configuration
command.
This example shows how to enable IEEE 802.1x authentication and to allow multiple hosts:
Switch(config)# interface gigabitethernet2/0/1
Switch(config-if)# dot1x port-control auto
Switch(config-if)# dot1x host-mode multi-host
Switch(config-if)# end
This example shows how to enable MDA and to allow both a host and a voice device on the port:
Switch(config)# interface gigabitethernet3/0/1
Switch(config-if)# dot1x port-control auto
Switch(config-if)# dot1x host-mode multi-domain
Switch(config-if)# switchport voice vlan 101
Switch(config-if)# end
OL-8550-02
Purpose
Enter global configuration mode.
Configure the network access server to recognize and use vendor-specific
attributes (VSAs).
Specify the port to which multiple hosts are indirectly attached, and enter
interface configuration mode.
The keywords have these meanings:
single-host–Allow a single host (client) on an
•
IEEE 802.1x-authorized port.
multi-host–Allow multiple hosts on an IEEE 802.1x-authorized port
•
after a single host has been authenticated.
multi-domain–Allow both a host and a voice device, such as an IP
•
phone (Cisco or non-Cisco), to be authenticated on an
IEEE 802.1x-authorized port.
You must configure the voice VLAN for the IP phone when the
Note
host mode is set to multi-domain. For more information, see
Chapter 15, "Configuring Voice VLAN."
Make sure that the dot1x port-control interface configuration command
set is set to auto for the specified interface.
(Optional) Configure the voice VLAN.
Return to privileged EXEC mode.
Verify your entries.
(Optional) Save your entries in the configuration file.
Catalyst 3750 Switch Software Configuration Guide
Configuring IEEE 802.1x Authentication
10-29