Identity Baseline 802.1X Configuration Guide - Chapter 3 - Configuring 802.1X

Sep 17, 2026

Uploaded by Blaney

Chapter 3 explains the core concepts and deployment assumptions for 802.1X authentication in an enterprise campus. It clarifies roles of the supplicant, authenticator, and authentication server, and shows how Cisco Catalyst switches act as authenticators using EAPoL with clients and RADIUS with the server. The chapter provides Cisco IOS requirements, including AAA enablement, RADIUS server parameters, global IEEE 802.1X activation, and per-interface configuration for Layer-2 access ports.

LanguageEnglish

CategoryPresentations

FormatPDF

Pages164

Reading Time57 min

AccessFree to download

Configuring 802.1X

802.1X components and reference topology

Basic authenticator configuration on Cisco Catalyst switches

Cisco IOS: enabling IEEE 802.1X commands

RADIUS configuration for Cisco IOS

Global and interface IEEE 802.1X configuration

Strictly Cisco Confidential C H A P T E R Configuring 802.1X 3 The three principal conceptual components of 802.1X are the supplicant, the authenticator, and the authentication server. Each of these components must be configured correctly for successful 802.1X authentication to occur. Of the three key components, the authenticator is the only one from which configuration is completely independent of the EAP method. A Cisco Catalyst switch will be configured in the same way regardless of whether EAP-TLS, PEAP-MSCHAP, or EAP-FAST (or any EAP method) is used to authenticate the supplicant. In contrast, the supplicant and the authentication server are configured differently depending on the chosen EAP method. The configuration steps listed in this guide are for a standard reference topology that represents atypically Enterprise environment. This topology is represented in Figure 3-1 . Figure 3-1 Standard Campus Design Access Distribution/Core Data Center 223858 Identity Baseline 802.1X Configuration Guide OL-16033-01 3-1 Authenticators Strictly Cisco Confidential The processes and procedures presented in this guide make the following assumptions: • The network has been deployed following current best practices for Campus Design. • Basic network connectivity exists between all components. • DNS and DHCP are fully operational. • The Windows domain has been configured in Active Directory. The domain controller is a Windows 2003 Server. • For certificate auto-enrollment to work, the Windows Certificate Authority must run on a Windows 2003 Enterprise Edition domain member server. • Cisco ACS runs on a domain member server. Cisco ACS software has been installed. • Client machines with Windows XP Service Pack 2 with CSSC (if used) are installed. Authenticators This section details the basic configuration of the Cisco Catalyst switch deployed as an authenticator inan 802.1X deployment. The authenticator controls physical access to the network based on the authentication status of the client. The authenticator acts as an intermediary between the client and the authentication server, requesting identity information from the client, verifying that information with the authentication server, and relaying a response to the client. The authenticator communicates with the client via EAPoL and with the authentication server via RADIUS. The basic configuration of the Cisco Catalyst switch remains constant within any IEEE 802.1X deployment regardless of the EAP method chosen for authentication. The EAP method is agreed upon by the client and authentication server and the authenticator simply proxies the information between the two of them. Cisco IOS Cisco Catalyst switches running Cisco IOS require certain commands to enable IEEE 802.1X. Additional commands can be configured to enable optional functionality or change default parameters. The necessary global and interface commands are explained in the following sections. A basic example is also provided to highlight the recommended configuration requirements. These configurations are valid for the versions listed in Table 3-1 . Table 3-1 Software Supported and Tested | Platform and OS | Minimum Supported OS Version | OS Version Tested | | --- | --- | --- | | Cisco Catalyst 6500 CatOS | 6.2(2) | 8.6(1) | | Cisco Catalyst 6500 Cisco IOS | 12.1(12b)E | 12.2(33)SXH | | Cisco Catalyst 4500 Cisco IOS | 12.1(12c)EW | 12.2(37)SE | | Cisco Catalyst 3750 Cisco IOS | 12.1(11)AX | 12.2(40)SG | Identity Baseline 802.1X Configuration Guide Authenticators Strictly Cisco Confidential RADIUS Configuration for Cisco IOS RADIUS is the protocol the switch uses to communicate with the ACS server during 802.1X authentication. The RADIUS commands required to configure IEEE 802.1X on a Cisco Catalyst switch running Cisco IOS are provided in this section. These commands are all entered at the CLI configuration mode. Step 1 Enable AAA globally with

FAQs

What are the three principal components of 802.1X authentication?

The supplicant, the authenticator, and the authentication server. Each must be configured correctly for successful 802.1X authentication to occur.

How does the authenticator (Cisco Catalyst switch) interact with the client and the authentication server?

The authenticator communicates with the client via EAPoL and with the authentication server via RADIUS, requesting identity information, verifying it with the server, and relaying responses to the client.

What are the key Cisco IOS steps to configure RADIUS and enable IEEE 802.1X globally and per interface?

Enable AAA globally, configure authentication dot1x to use group radius, set the RADIUS server host and shared key, enable IEEE 802.1X system-auth-control globally, then configure each interface (or an interface range) using static Layer-2 access/voice VLAN ports and set the appropriate switchport mode.

Sep 17, 2026

Uploaded by Blaney