Users Guide

Authentication, Authorization, and Accounting 265
3 Enable authentication and globally enable 802.1x client authentication via
RADIUS:
console(config)#authentication enable
console(config)#aaa authentication dot1x default radius
console(config)#dot1x system-auth-control
4 On the interface, set the port to access mode, assign a PVID, enable Multi-
Domain mode, enable MAB, and set the order of authentication to 802.1X
followed by MAC authentication. Configure the switch to send CHAP
attributes to the RADIUS server. Set the format of the User-Name sent to
the RADIUS server to XXXX.XXXX.XXXX. Also enable periodic re-
authentication.
console(config)#mab request format attribute 1 groupsize 4
separator . uppercase
console(config)#vlan 2
console(config-vlan2)#interface gi1/0/4
console(config-if-Gi1/0/4)#switchport mode access
console(config-if-Gi1/0/4)#switchport access vlan 2
console(config-if-Gi1/0/4)#authentication host-mode multi-
domain
console(config-if-Gi1/0/4)#dot1x pae authenticator
console(config-if-Gi1/0/4)#mab
console(config-if-Gi1/0/4)#mab auth-type chap
console(config-if-Gi1/0/4)#authentication order dot1x mab
console(config-if-Gi1/0/4)#authentication periodic
console(config-if-Gi1/0/4)#exit
Configuration Example — 802.1X Critical VLANs
In this example, both a critical data and critical voice VLAN are configured. A
test user ID is configured for determining the RADIUS server liveness. The
test user must NOT be an actual login on the RADIUS server.
1 Enter global configuration mode, enable 802.1X authentication and
configure the RADIUS server.
console#configure
console(config)#aaa new-model
console(config)#dot1x system-auth-control
console(config)#radius server auth 10.10.10.10
console(config-auth-radius)#name BigRadius
console(config-auth-radius)#key thatsyoursecret-keepit-keepit
console(config-auth-radius)#automate-tester username tst
idle-time 1
console(config-auth-radius)#deadtime 1