Reference Guide

CPPM-Demo-3750(config-if)# exit
CPPM-Demo-3750(config)#interface vlan 50
CPPM-Demo-3750(config-if)# ip address 192.168.50.1 255.255.255.0
CPPM-Demo-3750(config-if)# ip helper-address 192.168.99.10
CPPM-Demo-3750(config-if)# ip helper-address 192.168.99.5
CPPM-Demo-3750(config-if)# exit
Notes:
192.168.99.5 is the DHCP server and will vary based on the local configuration. 192.168.99.10
refers to CPPM for the DHCP request in order for the device to be profiled.
Verify the RADIUS server settings and applicable VLANs router interfaces for the VLANs have been set
prior to configuring a port to perform the 802.1x and MAC authentication bypass (also known as MAC
authentication fallback).
Determine the interface type and numbering conventions using the “show interfaces description”
command. The following list of interfaces (ports) will be displayed:
Fa = FastEthernet or 100Mbps
Gi = GigabitEthernet or 1,000Mbps
Use Fa1/0/24, which is the 24
th
copper port on our 3750. Use the following commands for port
configuration:
Note: Interface type and numbering will differ from model to model.
CPPM-Demo-3750(config)# interface FastEthernet1/0/24
CPPM-Demo-3750(config-if)# switchport access vlan 333
CPPM-Demo-3750(config-if)# switchport mode access
CPPM-Demo-3750(config-if)# authentication order dot1x mab
CPPM-Demo-3750(config-if)# authentication priority dot1x mab
CPPM-Demo-3750(config-if)# authentication port-control auto
CPPM-Demo-3750(config-if)# authentication periodic
CPPM-Demo-3750(config-if)# authentication timer reauthenticate server
CPPM-Demo-3750(config-if)# mab
CPPM-Demo-3750(config-if)# dot1x pae authenticator
CPPM-Demo-3750(config-if)# dot1x timeout server-timeout 30
CPPM-Demo-3750(config-if)# dot1x timeout tx-period 10
CPPM-Demo-3750(config-if)# dot1x timeout supp-timeout 30
CPPM-Demo-3750(config-if)# dot1x max-req 3
CPPM-Demo-3750(config-if)# dot1x max-reauth-req 10
CPPM-Demo-3750(config-if)# spanning-tree portfast
CPPM-Demo-3750(config-if)# exit
Set the port to access mode (untagged) with an untagged VLAN of 333 (the untrusted devices VLAN).
MAC Authentication Bypass (MAB) permits the port to perform MAC authentication if the switch detects
that the device is not 802.1x capable.
MAB occurs after 40 seconds:
(max-reauth-requests + 1) *tx-period = 802.1x authentication timeout.
The values provided for these port settings are for lab and evaluation tests only! Consult the Cisco
document titled, Configuring 802.1X Port-Based Authentication, and work with Cisco Support directly
to determine the correct port settings for your environment.
14 | ClearPass Policy manager Cisco Switch Setup with CPPM