Using Ieee 802.1X Authentication With Inaccessible Authentication Bypass - Cisco 3020 - Catalyst Blade Switch Configuration Manual
Cisco catalyst blade switch 3020 for hp software configuration guide, rel. 12.2(25)sef1
Hide thumbs
Also See for 3020 - Cisco Catalyst Blade Switch:
- Command reference manual (744 pages) ,
- Release note (54 pages) ,
- Getting started manual (37 pages)
Table of Contents
Advertisement
Understanding IEEE 802.1x Port-Based Authentication
Using IEEE 802.1x Authentication with Inaccessible Authentication Bypass
When the switch cannot reach the configured RADIUS servers and hosts cannot be authenticated, you
can configure the switch to allow network access to the hosts connected to critical ports. A critical port
is enabled for the inaccessible authentication bypass feature, also referred to as critical authentication
or the AAA fail policy.
When this feature is enabled, the switch checks the status of the configured RADIUS servers whenever
the switch tries to authenticate a host connected to a critical port. If a server is available, the switch can
authenticate the host. However, if all the RADIUS servers are unavailable, the switch grants network
access to the host and puts the port in the critical-authentication state, which is a special case of the
authentication state.
The behavior of the inaccessible authentication bypass feature depends on the authorization state of the
port:
•
•
•
When a RADIUS server that can authenticate the host is available, all critical ports in the
critical-authentication state are automatically re-authenticated.
Inaccessible authentication bypass interacts with these features:
•
Cisco Catalyst Blade Switch 3020 for HP Software Configuration Guide
7-14
If the port is unauthorized when a host connected to a critical port tries to authenticate and all servers
are unavailable, the switch puts the port in the critical-authentication state in the
RADIUS-configured or user-specified access VLAN.
If the port is already authorized and re-authentication occurs, the switch puts the critical port in the
critical-authentication state in the current VLAN, which might be the one previously assigned by
the RADIUS server.
If the RADIUS server becomes unavailable during an authentication exchange, the current
exchanges times out, and the switch puts the critical port in the critical-authentication state during
the next authentication attempt.
Guest VLAN—Inaccessible authentication bypass is compatible with guest VLAN. When a guest
VLAN is enabled on IEEE 8021.x port, the features interact as follows:
–
If at least one RADIUS server is available, the switch assigns a client to a guest VLAN when
the switch does not receive a response to its EAP request/identity frame or when EAPOL
packets are not sent by the client.
If all the RADIUS servers are not available and the client is connected to a critical port, the
–
switch authenticates the client and puts the critical port in the critical-authentication state in the
RADIUS-configured or user-specified access VLAN.
If all the RADIUS servers are not available and the client is not connected to a critical port, the
–
switch might not assign clients to the guest VLAN if one is configured.
If all the RADIUS servers are not available and if a client is connected to a critical port and was
–
previously assigned to a guest VLAN, the switch keeps the port in the guest VLAN.
Chapter 7
Configuring IEEE 802.1x Port-Based Authentication
OL-8915-01
Advertisement
Table of Contents
Troubleshooting
