Use 802.1x for automatic VLAN allocation

Device environment: Cisco Catalyst 3550-24-EMIIOS: 12.1 (14) EA1 EMI), Cisco Secure ACS v3.1
1. Main configurations of 802.1x vswitches:
Aaa new-model
Aaa authentication dot1x default group radius
Aaa authorization network default group radius
! --- If only 802.1x authentication is performed, aaa authorization network is not required. For VLAN allocation or per-user ACL, network authorization is required.
Dot1x system-auth-control
! --- Note that the configuration of 802.1x has been modified after 12.1 (14) EA1.
Interface FastEthernet0/1
Description To Server_Farm
Switchport mode access
Dot1x port-control auto
Dot1x max-req 3
Spanning-tree portfast
! --- In the dot1x port-control auto statement, enable dot1x on F0/1. Note that I didn't assign VLAN to the port F0/1.

Radius-server host 1.2.3.4 auth-port 1812 acct-port 1813 key radius_string
Radius-server vsa send authentication
! --- Radius-server host 1.2.3.4 defines the radius server information and provides the verification string
! --- To configure VLAN allocation, the VSA value specified by IETF must be used. The radius-server vsa send authentication clause allows the switch to identify and use these VSA values.
The VSA value used to configure 802.1x dynamic VLAN allocation is as follows:
[64] Tunnel-Type = VLAN
[65] Tunnel-Medium-Type = 802
[81] Tunnel-Private-Group-ID = VLAN name or VLAN ID
2. Main configuration of ACS related to 802.1x:
This configuration is shown in the figure. In addition, the Cisco document says that ACS 3.0 does not support 802.1x. Because 802.1x uses radius for authentication, I use RADIUS (IETF) when selecting the authentication protocol, and the default is Cisco TACACS +.
Configure RADIUS (IETF) in Interface Configuration, select [64] Tunnel-Type, [65] Tunnel-Medium-Type, and [81] Tunnel-Private-Group-ID in Group user attributes ).
In Group Setup, edit the value of RADIUS Vendor-Specific Attributes: select [64] Tunnel-Type and select the value of tag 1 as the VLAN. Select [65] Tunnel-Medium-Type, select 802 for the value of tag 1. Select [81] Tunnel-Private-Group-ID, and set the value of tag 1 to 7, which indicates that it is a VLAN. After setting, Submit + Rest.
3. workstation settings:
WINXP itself has built-in support for 802.1x. Microsoft recently released a patch to allow WIN2K to support 802.1x. Note that WIN2K SP4 has built-in support for 802.1x, this patch can be used below SP3:
Http://support.microsoft.com/default.aspx? Scid = kb; en-us; 313664
After the patch is installed, 802.1x is disabled by default. You can manually enable the Wireless Configuration Service in the service. After the service is enabled, the Authenticatioin column appears in the NIC connection attribute, select Enable network access control using IEEE 802.1x in this column, and select the MD5-Challenge in EAP type.
4. test:
After all the settings are complete, you can observe that the status light on port F0/1 of 802.1x enable is displayed as a yellow light. After a while, an Authentication Window will pop up on the workstation, enter the user name/password defined in ACS in the user name/password field. Do not fill in the Domain Name field. Observe the connection icon at WIN2K Ray. There will be a floating prompt with the authentication server contact and the authentication user, at the same time, the status light of F0/1 will also change to a green light.
After passing the authentication, check whether the VLAN value is correctly allocated: ping the gateway address of VLAN7, ping the gateway address of other VLANs, and check whether the VLAN value can be connected to the Internet.
For more information about how to configure the ACS Interface Configuration, see.

ACS Group Setup setting legend network connection Property setting legend

Note:
1. The ip address can be set to 3550 as the dhcp server, and the ip address is displayed as 802. 1x activates the port and uses dhcp to separate ip addresses. As for the mac address, it is unnecessary to bind the port, with 802. Vmps pulling and 802 are not required for 1x. 1x can be divided into VLANs based on the user name.

2. Check the IP address of each computer. For example, if 6509 is used for DHCP, the allocated IP address is fixed after the vlan tag is obtained through port activation. Because we developed an analysis software for firewall logs based on IP addresses. In this case, I want to assign a fixed IP address to the client. However, the client computer needs to obtain a fixed IP address from DHCP.