Users Guide

Security Commands 883
IP-Address, NAS-IP-Address (if configured in switch), NAS-Port identifiers
are maintained in the switch for 802.1X session identification. CoA-Request
requests must contain at least one of the Acct-Session-Id, Framed-IP-Address,
User-Name, or Calling-Station-Id for presentation to the NAS for CoA
requests.
A valid authenticated RFC 3575 Disconnect-Request terminates the session
without disabling the port. The termination may cause the host to attempt to
reauthenticate on the port. If an ACL was applied for the session, the ACL is
removed when the session is terminated.
If a valid authenticated RFC 3575 Disconnect-Request request is received
from a configured server and the session cannot be found, the switch returns a
CoA-NAK message with the 503 Session Context Not Found response code.
If it expected that more than one session will authenticate over a port, use of
MAC based authentication is recommended. If MAC based authentication is
enabled, the user is denied access to the port even if a previous authentication
has occurred on the port.
Command History
Introduced in version 6.2.0.1 firmware.
Example
The following example configures RADIUS servers at 1.1.1.1, 2.2.2.2, and
3.3.3.3 and CoA clients at 4.4.4.4 and 5.5.5.5. It sets the front panel ports to
use 802.1x MAC-based authentication. CoA is configured for two dynamic
RADIUS servers located at 1.1.1.1 and 2.2.2.2 using a global shared secret and
a third server using a server specific shared secret. CoA and disconnect
requests are accepted from the CoA clients at 4.4.4.4 and 5.5.5.5. Any
attribute contained in the Disconnect request is allowed for session
identification. In this example, the NAS-IP-Address is optionally configured
at the fixed IPv4 address of 3.3.3.3. CoA client 5.5.5.5 uses the global server
key while client 4.4.4.4 uses a client-specific server key.
console#configure terminal
console(config)# aaa new-model
console(config)# aaa authentication dot1x default radius
console(config)# dot1x system-auth-control
console(config)# interface range gi1/0/1-24
console(config-if)# dot1x port-control mac-based
console(config-if)# exit