11-29-2010 05:41 PM - edited 03-09-2019 11:17 PM
Hi,
I have successfully configured my switch for 802.1x with mmulti-domain. The IP Phone and workstation gets assigned to ther respective VLANS. My issue is when I connect a sepearet hub to a switch port with multiple workstations connected to the hub. I can only get one mac address to gain access to the network. Subsequent devices are restricted from gaining connection.
Is there configuration that I can apply to change the default behavior of allowing only a single mac address per domain on the switch port?
Thanks
Solved! Go to Solution.
12-01-2010 11:26 PM
Well, you can use multiple-authentication mode.
Multiple-authentication (multiauth) mode allows one client on the voice VLAN and multiple authenticated clients on the data VLAN. When a hub or access point is connected to an 802.1x-enabled port, multiple-authentication mode provides enhanced security over multiple-hosts mode by requiring authentication of each connected client. For non-802.1x devices, you can use MAC authentication bypass or web authentication as the fallback method for individual host authentications to authenticate different hosts through by different methods on a single port.
Multiple-authentication mode is limited to eight authentications (hosts) per port.
Multiple-authentication mode also supports MDA functionality on the voice VLAN by assigning authenticated devices to either a data or voice VLAN, depending on the VSAs received from the authentication server.
VERY IMPORTANT: When a port is in multiple-authentication mode, all the VLAN assignment features, including the RADIUS server supplied VLAN assignment, the Guest VLAN, the Inaccessible Authentication Bypass, and the Authentication Failed VLAN do not activate.
This is the configuration commands:
HTH,
Tiago
--
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.
11-30-2010 12:02 AM
Hi,
Multidomain allows both a data device and voice device, such as an IP phone (Cisco or non-Cisco), to authenticate on the same switch port. The port is divided into a data domain and a voice domain.Only one device is allowed per domain.
If you want to allow more than one device on a dot1x port, you need to use multi-host mode.In multiple-hosts mode, you can attach multiple hosts to a single 802.1x-enabled port.
In this mode, only one of the attached clients must be authorized for all clients to be granted network access. If the port becomes unauthorized (re-authentication fails or an EAPOL-logoff message is received), the switch denies network access to all of the attached clients.
HTH,
Tiago
--
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.
12-01-2010 04:08 PM
Thanks Tiago,
So does this mean that I am unable to have multiple devices connected to a single switch port if I want to use a generic IP Phone switch port configuration.
Is the port-security maximum command applicable?
Thanks
12-01-2010 11:26 PM
Well, you can use multiple-authentication mode.
Multiple-authentication (multiauth) mode allows one client on the voice VLAN and multiple authenticated clients on the data VLAN. When a hub or access point is connected to an 802.1x-enabled port, multiple-authentication mode provides enhanced security over multiple-hosts mode by requiring authentication of each connected client. For non-802.1x devices, you can use MAC authentication bypass or web authentication as the fallback method for individual host authentications to authenticate different hosts through by different methods on a single port.
Multiple-authentication mode is limited to eight authentications (hosts) per port.
Multiple-authentication mode also supports MDA functionality on the voice VLAN by assigning authenticated devices to either a data or voice VLAN, depending on the VSAs received from the authentication server.
VERY IMPORTANT: When a port is in multiple-authentication mode, all the VLAN assignment features, including the RADIUS server supplied VLAN assignment, the Guest VLAN, the Inaccessible Authentication Bypass, and the Authentication Failed VLAN do not activate.
This is the configuration commands:
HTH,
Tiago
--
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.
12-19-2010 10:31 PM
Hi
I have a similar issue in that i have PC's running VM instances that require seperate authentication from the host PC. The host is connected via a Nortel phone connected to a c2960. The ports are authenticated on a Microsoft NPS server instead of a Cisco ACS.
Multi-domain seem the fail with this setup and i am experiencing some issues with multi-auth (the phone is placed in the data vlan) that should be the correct config. Would this be due to the fact that i am using a MS NPS seerver instead of a Cisco ACS and do not have the ability to setup av-pairs in MS?
Regards
Kobus
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide