Multi-Auth on 2960x

Ivo Kessler — Fri, 21 Feb 2020 18:39:27 GMT

Hi,

I try to configure a 2960x for mac authentication with Radius. For now I need only MAC authentication, no voice vlan, no different vlan´s. I just want to restrict access to the network to predefined MAC addresses.

In single host mode it works well... I see my client authenticated by Radius. But I´ll neet multi-auth on some ports but the option is not available, only multi-domain, multi-host and single-host:

xxx(config-if)#authentication host-mode ?
multi-domain Multiple Domain Mode
multi-host Multiple Host Mode
single-host SINGLE HOST Mode

this is what I did so far:

conf t
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius (optional)
dot1x system-auth-control
radius server radius
address ipv4 xx.xx.xx.xx auth-port 1812 acct-port 1813
timeout 2
retransmit 1
key *****
aaa session-id common
authentication mac-move permit

conf terminal
interface Gi0/11
switchport mode access
switchport access vlan 1
dot1x port-control auto
authentication order mab
authentication priority mab
mab

Thanks in advance

Ivo

Re: Multi-Auth on 2960x

chrisgray1 — Mon, 20 Nov 2017 11:12:49 GMT

Then is multi-host the option that you are looking for? It will allow multiple mac address on the same port to be authenticated.

Re: Multi-Auth on 2960x

agrissimanis — Mon, 20 Nov 2017 15:03:51 GMT

Multi-host will only authenticate the first MAC address that appears on the port and let all others through without authenticating them though.

@Ivo Kessler what IOS version are you running?

topic Re: Multi-Auth on 2960x in Network Access Control

Multi-Auth on 2960x

Re: Multi-Auth on 2960x

Re: Multi-Auth on 2960x