cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
427
Views
0
Helpful
1
Replies
edylamanta
Beginner

Doubts about 802.1x authentication using Control Policy (C3PL)

cuando mi cliente no soporta 802.1x, se supone que el puerto del switch debe permanecer en estado no autorizado. Pero no logro que esto funcione.

¿Sabe alguien como se logra esto?

This is may configuration:

aaa new-model

aaa authentication dot1x default group radius

aaa authorization network default group radius

radius server ServidorCPPM

address ipv4 192.168.1.1 auth-port 1812 acct-port 1813

key peppearste

dot1x system-auth-control

class-map type control subscriber match-any AAA-DOWN

match result-type aaa-timeout

exit

!

class-map type control subscriber match-all DOT1X-FAILED

match method dot1x

match result-type method dot1x authoritative

exit

!

class-map type control subscriber match-all DOT1X_NO_RESP

match method dot1x

match result-type method dot1x agent-not-found

exit

!

policy-map type control subscriber DOT1X-DEFAULT

event session-started match-all

  10 class always do-all

   10 authenticate using dot1x priority 10

event violation match-all

  10 class always do-all

   10 restrict

event agent-found match-all

10 class always do-all

   10 authenticate using dot1x

event authentication-failure match-all

10 class AAA-DOWN do-all

   10 terminate dot1x

  20 class DOT1X_NO_RESP do-all

   10 terminate dot1x

   20 unauthorize

30 class DOT1X-FAILED do-all

   10 terminate dot1x

  40 class always do-until-failure

   10 terminate dot1x

   20 authentication-restart 60

interface GigabitEthernet0/1

switchport mode access

service-policy type control subscriber DOT1X-DEFAULT

authentication periodic

authentication timer reauthenticate server

mab

access-session host-mode multi-auth

dot1x timeout tx-period 10

access-session port-control auto

dot1x pae authenticator

interface Vlan109

ip address 192.168.1.254 255.255.255.0


Thank you

1 REPLY 1
jalemanp
Cisco Employee

Se que ha pasado unos meses ya, pero logró resolver el problem?
Si no, cual es el estado del puerto con el comando "show access-session interface (interface_id) details_

Saludos,