Configure 802.1x authentication on a cisco Router

What is the use of 802.1x authentication configuration? This article describes the configuration principle and application process in detail from the authentication configuration and implementation of 802.1x. Configuration commands are provided for configuration operations.

To use port-based authentication, both the vswitch and the user's PC must support the 802.1x Standard and use the Scalable authentication protocol EAPOL on the LAN). 802.1x EAPOL is a layer-2 protocol, if 802.1x is configured on the switch port, after the device is detected on the port, the port is in the unauthenticated status, and no traffic except CDP, STP, and EAPOL is forwarded ), in this case, the customer PC can only use the EAPOL protocol to communicate with the switch. We need to install the 802.1x-enabled application on the customer PC windows to support 802.1x). Once the user passes authentication, the port starts forwarding data streams. When a user logs out, the switch port will return the unauthenticated status. or, if the customer has no data traffic for a long time, the authentication will be stopped due to timeout and the user needs to authenticate again.

The RADIUS server is required to configure 802.1x on the switch. Note that AAA can be implemented using RADIUS and TACACS +, but 802.1x only supports RADIUS Authentication.

Let's take a look at the Configuration:

Config) # aaa new-model 'start AAA.

Config) # radius-server host 192.168.1.100 key netdigedu configure the address and key of the RADIUS server.

Config) # aaa authentication dot1x default group radius 'configure the 802.1x default authentication method RADIU.

Config) # dot1x system-auth-control 'enable 802.1x authentication globally on the switch.

Config) # int fa0/24

Config-if) # switchport mode access

Config-if) # dot1x port-control auto' sets the 802.1x status of the interface.

There are three statuses:

Force-authorized: the port is always in the authentication status and traffic is forwarded. This is the default status.

Force-unauthorized: the port is always in the unauthenticated status and cannot forward traffic.

Auto: the port switches between the authentication and unauthenticated status by using 802.1x to exchange messages with the client. This is what we need, so we must use auto after the dot1x port-control command.

Config-if) # use the "Hub" or "Switch" command to connect multiple PCs under the "dot1x host-mode multi-host" switch port. By default, only one PC can be authenticated.

# Show dot1x all' view 802.1x configuration.