If the multihost mode is enabled on an IEEE 802.1X port, all hosts are placed in the same VLAN (specified by the RADIUS server) When IEEE 802.1X authentication is enabled on a port, you cannot configure a port VLAN that is equal to a voice VLAN. Examples of configuration errors include the following: All packets sent from or received on this port belong to this VLAN.Īssignment to the configured access VLAN prevents ports from appearing unexpectedly in an inappropriate VLAN because of aĬonfiguration error. The port is in the force authorized, force unauthorized, unauthorized, or shutdown state.Īn access VLAN is a VLAN assigned to an access port. IEEE 802.1X authentication is disabled on the port. The VLAN information from the RADIUS server is not valid.
No VLAN is supplied by the RADIUS server. The device port is always assigned to the configured access VLAN when any of the following conditions occurs: The IEEE 802.1X VLAN Assignment feature is available only on a switch port. Restrictions for IEEE 802.1X VLAN Assignment High-speed WAN interface cards (HWICs) without ACL support: The following cards or modules support switch ports:Įnhanced High-speed WAN interface cards (EHWICs) with ACL support: The following ISR-G2 routers are supported:
#CISCO IOS XE 802.1X SERIES#
The IEEE 802.1X VLAN Assignment feature is available only on Cisco 89x and 88x series integrated switching routers (ISRs) The port must be successfully authenticated. See the IEEE 802.1X Authenticator feature module for information. A method list describes the sequence and authentication method The authentication method list must be enabled and specified. See the Microsoft Knowledge Base article at the location and set the SupplicantMode registry to 3 and the AuthMode registry to 1.Īuthentication, authorization, and accounting (AAA) must be configured on the port for all network-related service requests. Stop message is not sent to the authentication server. You do not configure the IEEE 802.1X supplicant, an EAP-logoff message is not sent to the switch and the accompanying accounting You must configure the IEEE 802.1X supplicant to send an EAP-logoff (Stop) message to the switch when the user logs off.
#CISCO IOS XE 802.1X HOW TO#
The concepts of the RADIUS protocol and have an understanding of how to create and apply access control lists (ACLs).ĮAP support must be enabled on the RADIUS server.
The device must have a RADIUS configuration and be connected to the Cisco secure access control server (ACS). IEEE 802.1X must be enabled on the device port.
The following tasks must be completed before implementing the IEEE 802.1X VLAN Assignment feature: Prerequisites for IEEE 802.1X VLAN Assignment
0 kommentar(er)
