Users Guide

Authentication, Authorization, and Accounting 383
console(config-if)#authentication host-mode multi-auth
8 Enable periodic reauthentication of the client on the ports and set the
number of seconds to wait between reauthentication attempts to 300
seconds. Reauthentication is enabled to increase security by verifying that
another device is not spoofing the MAC address of the indirectly
connected devices.
console(config-if)#authentication periodic
console(config-if)#authentication timer reauthenticate 300
9 Set the unauthenticated VLAN on the ports to VLAN 200 so that any
client that connects to one of the ports and fails the 802.1X authentication
is placed in VLAN 200.
console(config-if)#event fail authorize vlan 200
10 Set the guest VLAN on the ports to VLAN 300. This command
automatically enables the Guest VLAN Mode on the downlink ports. Any
client that connects to the port and does not attempt to authenticate is
placed into the guest VLAN.
console(config-if)#authentication event no-response action
authorize 300
console(config-if)#exit
11 Enter Interface Configuration mode for port 24, the uplink (trunk) port.
console(config)#interface Gi1/0/24
12 Disable 802.1X authentication on the interface. This causes the port to
transition to the authorized state without any authentication exchange
required. This port does not connect to any end-users, so there is no need
for 802.1X-based authentication.
console(config-if-Gi1/0/24)#authentication port-control force-
authorized
13 Set the uplink port to trunk mode so that it accepts tagged traffic and
transmits it to the connected device (another switch or router).
console(config-if-Gi1/0/24)#switchport mode trunk