Apple wired Dot1X - on Cisco 2950 switches

[Tim Lewis]

Hi, I have an issue with Apple desktop computers running 10.7 and 10.8 MacOS.

The problem is that we have only 2950 switches and we are very limited with what we can do on them, so we wanted basic DOT1X user authentication and VLAN placement. Those two are working great, except when user logs off, Mac stops sending DOT1X and port becomes unauthenticated. We alleviated that issue by using guest-vlan for failed dot1x authentications, but now we have a problem that once user logs in, there is no session change on 2950 and it doesn’t even try to authenticate user until we bounce the port.

Is there any way to fix this, on Cisco switch or Mac computer? One of the things that crossed my mind is bouncing port on Mac PC using some kind of logon script?

Has anyone else had this issue and was able to solve it?

Thanks.

[Leo Laohoo]

I believe 2950 does not support 802.1x.

The cheapest switch that will support 802.1x is the 2960-series of switches.

[Ravi Singh · Accepted solution]

Hello Align,

Cisco 2950 switch with 12.1(9) supports 802.1 x authentications. As you are saying that you already configured 802.1x authentication and its working fine. I think there is problem with your MAC OS configuration. Please follow the below link to configure 802.1x on Apple.

http://support.apple.com/kb/ht3326

[myanuary]

Is 2950 really support 802.1x ? as far i know start on 2960, 802.1x is supported, just like Leo said....

[Ravi Singh]

Yes it is. Just see the below link for configuration 802.1x authentication on Cisco 2950 switch.

http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_9_ea1/configuration/guide/Sw8021x.html

[myanuary]

but it looks like doesn't support CoA...

[Leo Laohoo]

This is one of the main reason why we didn't use 2940/2950/2955 or 3550 for 802.1x.