port security based on computer certificate ?

[tedauction]

Hello, can someone please outline the basic functionality of how I could enable port security using 802.1x for specific computers only.

Is this done somehow using a certificate on each computer ?

Thank you kindly.

[Francesco Molino · Accepted solution]

Hi

To achieve that you'll need a radius server (like Cisco ISE, ACS or others...). 

To activate for specific computers, you need:

• Activate globally dot1x
• Activate dot1x on specific ports where are computers connected to

The authentication could be done in different ways:

• User certificate on the machine
• Machine certificate (for machines joined to active directory they get one)
• User/password (AD credentials)

Hope this clear enough.

Thanks

PS: Please don't forget to rate and mark add correct answer if this answered your question

[Reza Sharifi]

Hi,

You enable ports for 802.1x and to authenticate against radius server. See figure-1 and 2.

Here is the config guide with diagram and how to configure 802.1x

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_8021x/configuration/xe-3se/3850/sec-user-8021x-xe-3se-3850-book/config-ieee-802x-pba.html

HTH