Configure 802.1x on switch C9200-48PXG-A

[Electronic20]

Hi Community,

You will have a format to configure the 802.1x on the ports and on the C9200-48PXG-A switch.

Please your kind support

[DanielP211 · Accepted solution]

Hello,

What are you trying to achive? Are you looking for template of dot1x configuration? To connect to radius and configure a port use the following config (this does not include config on the ISE/NAC server).

aaa group server radius 8021x-servers
server name Server1
server name Server2

aaa authentication dot1x default group 8021x-servers
aaa authorization network default group 8021x-servers
aaa accounting dot1x default start-stop group 8021x-servers

dot1x system-auth-control
dot1x critical eapol

interface GigabitEthernet1/0/1
switchport mode access
authentication control-direction in
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 5
dot1x max-reauth-req 3

radius server Server1
address ipv4 XX.XX.XX.XX auth-port 1812 acct-port 1813
key 0 PRE-shared-KEY

radius server Server2
address ipv4 XX.XX.XX.XX auth-port 1812 acct-port 1813
key 0 PRE-shared-KEY

BR

[Electronic20]

Hi, @DanielP211 

That's right, a template to configure the switch port to 802.1x for security.

I have a question, would that affect the accounts of the Network Administrators when they want to log in to Cisco switches?

[DanielP211]

The configuration for access to the switches is seperate. You can use tacacs or radius. In short dot1x port configuration won't affect the switch login.

And the configuration is the following:
aaa group server radius RADIUS_SER
server name SERV1
server name SERV2

aaa authentication login default group RADIUS_SER local-case
aaa authorization exec default group RADIUS_SER local if-authenticated

radius server SERV1
address ipv4 XX.XX.XX.XX auth-port 1812 acct-port 1813
key XXX

radius server SERV2
address ipv4 XX.XX.XX.XX auth-port 1812 acct-port 1813
key XXX

BR

[Electronic20]

Hi @DanielP211 

thank you.
What show command can I use to verify 802.1x?

[DanielP211]

For all sessions:
show authentication session

For specific interface:
show authentication session interface gigX/X/X

BR

[Electronic20]

Hi @DanielP211 

Will you have the 802.1x configuration form in the ISE?

[DanielP211]

You have to configure the configuration in ISE. I assume you already have it? In other case you have to configure quite a few things... There is no easy configuration to paste so I will just point you to a implementation manual, and if you get stuck somewhere just ask.

You don't have to configure everthing but take a look at the following: Integrating ISE with Active Directory, Authoring Access Policies on ISE, Configuring Microsoft Windows and Apple OS X Devices for 802.1X...

https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

BR

[Electronic20]

thanks for the information