topic Re: 802.1X authentication in Network Access Control

802.1X authentication

roy-sam — Fri, 21 Feb 2020 18:12:15 GMT

Understand that dot1x can use either radius-eap or none as authentication method. However I cannot get it working with the following (No Authentication) :

> aaa authentication dot1x default none

However, my 802.1x works fine when I specify

> aaa authentication dot1x default group radius

So, why does the Cisco 3550 still prompt me for EAP authentication despite the authentication method is none?

Re: 802.1X authentication

jafrazie — Thu, 10 Feb 2005 04:39:51 GMT

dot1x cannot use "none" as an authentication method. This is a legacy left-over from existing aaa configs, and does not work with EAP. Currently, if EAP breaks for any reason authentication cannot complete.

Hope this helps.

Re: 802.1X authentication

zhichao — Thu, 03 Mar 2005 07:53:26 GMT

In that case, how do we backup the radius server? Assuming we only have one radius.

thanks

Re: 802.1X authentication

jafrazie — Thu, 03 Mar 2005 16:00:59 GMT

Well, assuming you only had one, and didn't build any redundancy, 802.1x would not work for any subsequent auth sessions.

What would you need it to do?

Automatically unconfigure 802.1x when RADIUS dies?

Automatically unconfigure 802.1x when RADIUS dies and place into some other VLAN, so as not to "disturb" any other auth'd clients?

Fail closed?

Re: 802.1X authentication

zhichao — Fri, 04 Mar 2005 05:33:08 GMT

We are not doing dynamic vlan assignment.

When Radius dies, the switch should by default authorize all the users.

If customer using dynamic vlan assignment, I will vote for the second option:

Automatically unconfigure 802.1x when RADIUS dies and place into some other VLAN, so as not to "disturb" any other auth'd clients?

maybe use Guest vlan method.