Users Guide

Authentication, Authorization, and Accounting 375
aaa authentication
dot1x default
method1
Specify the authentication method to use to authenticate
802.1X clients that connect to the switch.
method1 —The method keyword can be radius, none, or
ias.
authentication monitor Globally enable 802.1X authentication on the switch.
interface
interface Enter interface configuration mode for the specified
interface. The
interface variable includes the interface type
and number, for example tengigabitethernet 1/0/3.
A range of interfaces can be specified using the interface
range command. For example, interface range
tengigabitethernet 1/0/8-12 configures interfaces 8, 9, 10,
11, and 12.
authentication port-
control {force-
authorized | force-
unauthorized | auto}
Specify the authentication mode for the port.
NOTE: For standard 802.1X implementations in which one
client is connected to one port, use the authentication port-
control auto command to enable 802.1X authentication on the
port.
• auto — Enables 802.1X authentication on the interface
and causes the port to transition to the authorized or
unauthorized state based on the 802.1X authentication
exchange between the switch and the client. Once the
port is authenticated by any host, additional hosts on the
port will have access to network resources using the port
PVID.
• force-authorized — Disables 802.1X authentication on
the interface and causes the port to transition to the
authorized state without any authentication exchange
required. The port sends and receives normal traffic
without 802.1X-based authentication of the client.
• force-unauthorized — Denies all access through this
interface by forcing the port to transition to the
unauthorized state, ignoring all attempts by the client to
authenticate. The switch cannot provide authentication
services to the client through the interface.
mab [auth-type
{pap|eap-md5|chap}]
This command can be used to enable MAB on the
interface and select the authentication type.
Command Purpose