topic dot1x commands missing from IOS in Network Access Control

dot1x commands missing from IOS

Richard Klinkbeil — Mon, 11 Mar 2019 07:42:02 GMT

Hey all, I have this weird issue and its probably just an IOS versioning thing.

I currently have "Version 15.1(2)SY6, RELEASE SOFTWARE (fc4)" running on my C6509 (non E chassis) and I do not have the ability to implement dot1x on switchports.

If I turn the switchport into a routed port, I then have all the dot1x commands available. Everything I read says 12.2.xx and on supports it.

Will I need to go back to IOS 12 in order to restore the dot1x commands on all switchports? I could have sworn I had dot1x running before, but I did upgrade to version 15 awhile ago, so I cant remember what version I was on when it worked.

Hi Richard

Mohamed Abd Elnaser Mohamed Mohamed Ali — Sun, 07 May 2017 19:50:19 GMT

Hi Richard

It sound wired what you have, but does the command executes with an error or it doesn't accept the command at all.

I assume that 802.1X is globally enabled (via dot1x system-auth-control) since it applies to the Routed ports.

One silly thing I should ask before configuring this 802.1x commands, do your interfaces are configured as static switchports (via switchport and switchport mode access) commands as it would reject dot1x commands if it isn't configured.

Do you have Port security enabled with sticky MAC addresses or static secure MAC addresse on these ports you are trying to configure as with Release 15.1(1)SY1 and later, you cannot configure 802.1X authentication with port security with sticky MAC addresses or static secure MAC addresses.

Good question. By default the

Richard Klinkbeil — Mon, 08 May 2017 14:39:43 GMT

Good question. By default the ports will be "routed" so initially I will enter the "switchport" and "switchport mode access" commands to get them where I need them to be.

Port security is currently not enabled on the ports. And dot1x is enabled globally.

Also, the line cards in question are WS-X6148A-GE-45AF. I also have a WS-X6724-SFP and it has all of the dot1x commands available.

Try first assigning the

Marvin Rhoads — Mon, 08 May 2017 15:16:08 GMT

Try first assigning the switchports to an access VLAN - even if it is VLAN 1.

Without an explicit assignment to a VLAN, the interface level dot1x commands aren't always available.

Marvin, I do have them in a

Richard Klinkbeil — Wed, 10 May 2017 04:57:44 GMT

Marvin, I do have them in a vlan, see below for the generic config on each port.

interface GigabitEthernet1/30
description THEATER
switchport
switchport access vlan 40
spanning-tree portfast edge
end

Hi Richard

Mohamed Abd Elnaser Mohamed Mohamed Ali — Wed, 10 May 2017 05:31:14 GMT

Hi Richard

Did you configure the ports as a static access port with "switchport mode access" and checked if the dot1x command is accepted or there.