Configuring dot1x
I have been flying though some of the labs and the experience is really humbling there is tonnes of stuff that I have never configured before and it takes me a little bit of time to get used to. One of these items is dot1x authentication so below is a brief command reference/primer for the commands.
Right first off we need to enable the aaa new model
DistSwitch(config)#aaa new-model
Then we need to configure dot1x to be used for authentication and as dot1x uses radius define the radius server, pretty standard stuff
DistSwitch(config)#aaa authentication dot1x default group radius DistSwitch(config)#radius-server host 10.10.10.100 key secretkey
To prevent bad things from happening such as locking yourself out use the following command to only use local login for the lines
DistSwitch(config)#aaa authentication login default line
Now for the interface configuration, to use dot1x the ports must be access ports so lets sort that out
interface FastEthernet0/1 switchport mode access
This is the most important command and specifies that the port should be either force-authorised where the port is always allowed on the network, force-unauthorised where the port is never allowed on the network, and finally auto where the port is either authorised if dot1x authentication succeeds or unauthorised if it doesnt.
DistSwitch(config-if)#dot1x port-control ? auto PortState will be set to AUTO force-authorized PortState set to Authorized force-unauthorized PortState will be set to UnAuthorized
Still on the interface there are are a couple more useful commands, the next command puts the port into the specified vlan if authentication fails
DistSwitch(config-if)#dot1x auth-fail vlan 666
And this command puts the port in the specified vlan if the connected host does not support dot1x, handy for guests
DistSwitch(config-if)#dot1x guest-vlan 90
And always there is a couple of show commands that we need to do to check that everything is working correctly. To check the queries and responses sent to each radius server just use;
DistSwitch#show aaa servers
RADIUS: id 1, priority 1, host 10.10.10.100, auth-port 1645, acct-port 1646
State: current UP, duration 1743s, previous duration 0s
Dead: total time 0s, count 0
Quarantined: No
Authen: request 0, timeouts 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 0
Author: request 0, timeouts 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 0
Account: request 0, timeouts 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 0
Elapsed time since counters last cleared: 12m
And to see the dot1x interface specific information the following command provides that information
DistSwitch#show dot1x interface fa0/1 Dot1x Info for FastEthernet0/1 ----------------------------------- PAE = AUTHENTICATOR PortControl = AUTO ControlDirection = Both HostMode = SINGLE_HOST Violation Mode = PROTECT ReAuthentication = Disabled QuietPeriod = 60 ServerTimeout = 0 SuppTimeout = 30 ReAuthPeriod = 3600 (Locally configured) ReAuthMax = 2 MaxReq = 2 TxPeriod = 30 RateLimitPeriod = 0 Auth-Fail-Vlan = 666 Auth-Fail-Max-attempts = 3 Guest-Vlan = 90
