IOS doesn't accept dot1x commands on 4510r+e

[Josh Morris]

I am running a 4510 with a SUP-8. I am trying to implement 802.1x for NAC, but the switch refuses the interface-level command. Below is the entire config I am trying to implement and the results. Any ideas as to why it rejects the interface level commands?

! dot1x

aaa authentication dot1x   default group radius

aaa authorization network   default group radius

aaa authorization auth-proxy   default group radius

aaa accounting dot1x default   start-stop group radius

aaa accounting network   default start-stop group radius

aaa accounting system default   start-stop group radius

aaa accounting update   periodic 15

aaa accounting update newinfo

radius-server attribute 6   on-for-login-auth

radius-server attribute 8   include-in-access-req

radius-server attribute 25   access-request include

radius-server dead-criteria   time 30 tries 3

radius server ISE

address ipv4 10.40.0.2 auth-port 1812   acct-port 1813

address ipv4 10.40.0.4 auth-port 1812   acct-port 1813

key 0 xxxxxxxxxxxx

radius-server vsa send   accounting

radius-server vsa send   authentication

ip radius source-interface   Vlan500

!

ip arp inspection vlan 15

ip dhcp snooping vlan 15

no ip dhcp snooping information option

ip dhcp snooping

ip device tracking

!

dot1x system-auth-control

dot1x critical eapol

! interface g1/5 switchport access vlan 15 switchport voice vlan 65 logging event link-status service-policy input QoS-Input-Policy service-policy output   QoS-Host-Port-Output-Policy authentication event fail action next-method authentication event server dead action   authorize vlan 1500 authentication event server alive action   reinitialize authentication host-mode multi-auth authentication open authentication order mab dot1x authentication priority dot1x mab authentication port-control auto authentication timer reauthenticate server authentication periodic authentication violation restrict mab dot1x pae authenticator dot1x timeout tx-period 10 LAB-IDF(config)#int g1/5 LAB-IDF(config-if)# switchport access vlan 15 LAB-IDF(config-if)# switchport voice vlan 65 LAB-IDF(config-if)# logging event link-status LAB-IDF(config-if)# service-policy input QoS-Input-Policy % policy map QoS-Input-Policy not configured LAB-IDF(config-if)# service-policy output QoS-Host-Port-Output-Policy % policy map QoS-Host-Port-Output-Policy not configured LAB-IDF(config-if)# LAB-IDF(config-if)# authentication event fail action next-method                        ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)#$tion event server dead action authorize vlan 1500                               ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)# authentication event server alive action reinitialize                        ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)# authentication host-mode multi-auth                        ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)# authentication open                        ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)# authentication order mab dot1x                        ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)# authentication priority dot1x mab                        ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)# authentication port-control auto                        ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)# authentication timer reauthenticate server                        ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)# authentication periodic                        ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)# authentication violation restrict                        ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)# mab                       ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)# dot1x pae authenticator                         ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)# dot1x timeout tx-period 10                         ^ % Invalid input detected at '^' marker. LAB-IDF(config-if)#!

[Josh Morris]

Edit: I do know that the 'authentication' command shows as if it's not available under interface mode. I was wondering if there was maybe something else I have to turn on first before it's avaliable. Also, in the configuration guide, it says there shoudl be a 'dot1x' command in interface mode, but it's not there either.

[Jon Marshall · Accepted solution]

Josh

Can you add this to the port config -

int gi1/5

switchport mode access

Jon

[Josh Morris]

Thanks Jon, that solved the issue. I was thinking that 'switchport access vlan x' was enough to set the port to access. Thanks.

[Marvin Rhoads]

Hi Jon,

+5 two years later - I missed this one on a switch I was working on and found your answer.