topic Re:[ISE]Does Multi-auth work for hub only? How about switch? in Network Access Control

[ISE]Does Multi-auth work for hub only? How about switch?

yijiework — Mon, 11 Mar 2019 03:38:15 GMT

I need to use 2960s lanlite version as a access switch, but this model can do nothing with posture and web auth.

So I have to use multi-auth instead on compact switch for endpoint auth.

But I noticed only HUB can work with multi-auth.

Is there any solution for my requirement?

[ISE]Does Multi-auth work for hub only? How about switch?

Saurav Lodh — Thu, 11 Jul 2013 03:05:43 GMT

Refer "802.1x Multiple Authentication Mode " from below link

http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_53_se/configuration/guide/sw8021x.html

Re:[ISE]Does Multi-auth work for hub only? How about switch?

Tarik Admani — Thu, 11 Jul 2013 04:52:38 GMT

Hi you cannot use dot1x for hosts connected on a switch that is capable of spanning tree. The dot1x supplicant send frames to a reserved destination Mac that falls within the spanning tree range.

Basically any frames for dot1x are dropped from the switch behind the port.

Sent from Cisco Technical Support Android App

[ISE]Does Multi-auth work for hub only? How about switch?

Eduardo Aliaga — Thu, 11 Jul 2013 04:56:42 GMT

Multi-auth is designed when there are multiple endpoints connected to the same switchport and you want only one endpoint to authenticate. If one endpoint authenticates succesfully then all the other endpoints will enter the network without authentication.

So, when are multiple endpoints connected to a switchport ? Certainly when using a hub, but also when an automous access point, a laptop will multiple virtual machines, or even a switches connects to a switchport configured with 802.1x

Please rate if this helps

[ISE]Does Multi-auth work for hub only? How about switch?

yijiework — Thu, 11 Jul 2013 06:42:14 GMT

multi-auth-Allow one client on the voice VLAN and multiple authenticated clients on the data VLAN. Each host is individually authenticated.

A manual said this.

[ISE]Does Multi-auth work for hub only? How about switch?

yijiework — Thu, 11 Jul 2013 06:45:03 GMT

ADDITION:

I use 2960s as access switch, and haven't changed stock configuration.

Should I configurate it to make it work?

[ISE]Does Multi-auth work for hub only? How about switch?

Eduardo Aliaga — Thu, 11 Jul 2013 06:45:10 GMT

Yes you're right, I was thinking of "multi-host" instead of "multi-auth". Sorry for the confusion

[ISE]Does Multi-auth work for hub only? How about switch?

yijiework — Fri, 12 Jul 2013 03:07:57 GMT

So maybe I can make 802.1x work by disablling STP?

And if my access switchs use default configuration, should I disable STP on vlan1?

Re:[ISE]Does Multi-auth work for hub only? How about switch?

Tarik Admani — Sat, 13 Jul 2013 05:42:51 GMT

You shouldnt have to worry about your main switch. Just the switch plugged in behind it. Also make sure you have proper protection in place so a loop doesnt affect the rest of your network.

Sent from Cisco Technical Support Android App