Configuring dot1x
I have been flying though some of the labs and the experience is really humbling there is tonnes of stuff that I have never configured before and it takes me a little bit of time to get used to. One of these items is dot1x authentication so below is a brief command reference/primer for the commands.
Right first off we need to enable the aaa new model
DistSwitch(config)#aaa new-model
Then we need to configure dot1x to be used for authentication and as dot1x uses radius define the radius server, pretty standard stuff
DistSwitch(config)#aaa authentication dot1x default group radius DistSwitch(config)#radius-server host 10.10.10.100 key secretkey
To prevent bad things from happening such as locking yourself out use the following command to only use local login for the lines
DistSwitch(config)#aaa authentication login default line
Now for the interface configuration, to use dot1x the ports must be access ports so lets sort that out
interface FastEthernet0/1 switchport mode access
This is the most important command and specifies that the port should be either force-authorised where the port is always allowed on the network, force-unauthorised where the port is never allowed on the network, and finally auto where the port is either authorised if dot1x authentication succeeds or unauthorised if it doesnt.
DistSwitch(config-if)#dot1x port-control ? auto PortState will be set to AUTO force-authorized PortState set to Authorized force-unauthorized PortState will be set to UnAuthorized
Still on the interface there are are a couple more useful commands, the next command puts the port into the specified vlan if authentication fails
DistSwitch(config-if)#dot1x auth-fail vlan 666
And this command puts the port in the specified vlan if the connected host does not support dot1x, handy for guests
DistSwitch(config-if)#dot1x guest-vlan 90
And always there is a couple of show commands that we need to do to check that everything is working correctly. To check the queries and responses sent to each radius server just use;
DistSwitch#show aaa servers
RADIUS: id 1, priority 1, host 10.10.10.100, auth-port 1645, acct-port 1646
State: current UP, duration 1743s, previous duration 0s
Dead: total time 0s, count 0
Quarantined: No
Authen: request 0, timeouts 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 0
Author: request 0, timeouts 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 0
Account: request 0, timeouts 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 0
Elapsed time since counters last cleared: 12m
And to see the dot1x interface specific information the following command provides that information
DistSwitch#show dot1x interface fa0/1 Dot1x Info for FastEthernet0/1 ----------------------------------- PAE = AUTHENTICATOR PortControl = AUTO ControlDirection = Both HostMode = SINGLE_HOST Violation Mode = PROTECT ReAuthentication = Disabled QuietPeriod = 60 ServerTimeout = 0 SuppTimeout = 30 ReAuthPeriod = 3600 (Locally configured) ReAuthMax = 2 MaxReq = 2 TxPeriod = 30 RateLimitPeriod = 0 Auth-Fail-Vlan = 666 Auth-Fail-Max-attempts = 3 Guest-Vlan = 90
try
dot1x port-control auto
aaa authentication dot1x default group radius
and not
DistSwitch(config)#aaa authentication login default line
802.1x is a great tool with a poor OS support. I’m experiencing problems with WinXP clients and DHCP: the client gets an IP address from unauth VLAN and when the authentication completes it keeps the old ip address in the new vlan so a ipconfig /release and /renew is needed. I’m using WinXP SP2 and SP3 with the same results. The client-side problems are a big issue in implementing 802.1x, I had to pause the whole project. Other dot1x clients fix that problem but it’s hard to tell the customer to buy a new client and install it in >1000 clients when EAP is supposed to be a OS feature free of charge. What’s your experience?
Hey Roland, many of the sites in our network have implemented dot1x for the wireless clients, its setup so they can travel to institutions throughout the world and still use the same credentials and is pretty successful http://www.eduroam.org
The biggest barrier we have found to deployment is sites understanding the technology, apart from the problem you described with changing VLANs the technology seems ready for prime time.