Cisco IE 3000 Software Configuration Manual page 241
Hide thumbs
Also See for IE 3000:
- Hardware installation manual (186 pages) ,
- Getting started manual (32 pages) ,
- Software configuration manual (874 pages)
Table of Contents
Advertisement
Chapter 10
Configuring IEEE 802.1x Port-Based Authentication
Command
Step 1
configure terminal
Step 2
aaa new-model
Step 3
aaa authentication login default group
radius
Step 4
aaa authorization auth-proxy default
group radius
Step 5
radius-server host key radius-key
Step 6
radius-server attribute 8
include-in-access-req
Step 7
radius-server vsa send authentication
Step 8
ip device tracking
Step 9
end
This example shows how to enable AAA, use RADIUS authentication and enable device tracking:
Switch(config) configure terminal
Switch(config)# aaa new-model
Switch(config)# aaa authentication login default group radius
Switch(config)# aaa authorization auth-proxy default group radius
Switch(config)# radius-server host 1.1.1.2 key key1
Switch(config)# radius-server attribute 8 include-in-access-req
Switch(config)# radius-server vsa send authentication
Switch(config)# ip device tracking
Switch(config) end
OL-13018-01
Purpose
Enter global configuration mode.
Enable AAA.
Use RADIUS authentication. Before you can use this authentication
method, you must configure the RADIUS server. For more
information, see
Chapter 9, "Configuring Switch-Based
Authentication."
The console prompts you for a username and password on future
attempts to access the switch console after entering the aaa
authentication login command. If you do not want to be prompted for
a username and password, configure a second login authentication
list:
Switch# config t
Switch(config)# aaa authentication login line-console none
Switch(config)# line console 0
Switch(config-line)# login authentication line-console
Switch(config-line)# end
Use RADIUS for authentication-proxy (auth-proxy) authorization.
Specify the authentication and encryption key for RADIUS
communication between the switch and the RADIUS daemon.
Configure the switch to send the Framed-IP-Address RADIUS
attribute (Attribute[8]) in access-request or accounting-request
packets.
Configure the network access server to recognize and use
vendor-specific attributes (VSAs).
Enable the IP device tracking table.
To disable the IP device tracking table, use the no ip device tracking
global configuration commands.
Return to privileged EXEC mode.
Cisco IE 3000 Switch Software Configuration Guide
Configuring IEEE 802.1x Authentication
10-39
Advertisement
Chapters
Table of Contents
Troubleshooting
