topic Define RADIUS Server per Switchport in Network Access Control

Define RADIUS Server per Switchport

shillier.tha — Mon, 11 Mar 2019 04:20:03 GMT

Afternoon all,

I've been experimenting with dot1x on switchports, we have two seperate systems handling AAA at the moment and one of them is tied into the firewall/webfilter (school environment).

We would like to use the RADIUS server on that appliance to handle AAA for certain switchports in locations with personal devices attached, and then our internal Windows NPS to handle AAA for school devices in locations where personal devices will not be attached.

I found this thread:

https://supportforums.cisco.com/thread/2080794 from 2011 stating that it would not be possible (in the same kind of scenario) is this still the case in IOS 15? Can't find options to do it.

Apologies if this is a stupid question.

Steve

Define RADIUS Server per Switchport

Javier Henderson — Wed, 29 Jan 2014 23:40:11 GMT

Steve,

Am I correct here?

You want (for example) RADIUS server at 10.1.1.1 to handle switch ports GigabitEthernet 1-24 and RADIUS server 10.2.2.2 handle GigabitEthernet 25-48.

If that's the case, then define multiple authentication methods, and assign those methods to each port as appropriate.

For example:

aaa group server radius RAD1

server 10.1.1.1

aaa group server radius RAD2

server 10.2.2.2

aaa authenticaiton dot1x RAD1 group RADSER1

aaa authentication dot1x RAD2 group RADSER2

Now assign RAD1 to interfaces GigE 1-24 and RAD2 to interfaces GigE 25-48

Javier Henderson

Cisco Systems

Define RADIUS Server per Switchport

shillier.tha — Thu, 30 Jan 2014 06:28:02 GMT

Hi Javier

That is exactly it, thank you! I have come co close - I have the groups, servers and aaa config ready but do not know how to assign RAD1 to GigE 1-24 and RAD2 to interfaces GigE 25-48.

How do you achieve this?

Many thanks

Steve