Authentication Authorization and Accounting Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches) – MAC Authentication Bypass [Cisco IOS XE 3SE] – Cisco

Authentication authorization and accounting configuration guide, cisco ios release 12.4 – configuring mac authentication bypass [support]

Configuration examples for configuring mac authentication bypass

This section contains the following example:

•Example: Standalone MAB Configuration

Contents

•Prerequisites for Configuring MAC Authentication Bypass •Information About Configuring MAC Authentication Bypass •How to Configure Configuring MAC Authentication Bypass •Configuration Examples for Configuring MAC Authentication Bypass •Additional References •Feature Information for Configuring MAC Authentication Bypass

Enabling reauthentication on a port

By default, ports are not automatically reauthenticated. You can enable automatic reauthentication and specify how often reauthentication attempts are made.

Example: standalone mab configuration

The following example shows how to configure standalone MAB on a port. In this example, the client is reauthenticated every 1200 seconds and the connection is dropped after 600 seconds of inactivity.

enable

 configure terminal

  interface GigabitEthernet2/1

   switchport

   switchport mode access

   switchport access vlan 2

   authentication port-control auto

   mab

   authentication violation shutdown 

   authentication timer restart 30 

   authentication periodic 

   authentication timer reauthenticate 1200 

   authentication timer inactivity 600 

Feature information for configuring mac authentication bypass

Table 1 lists the features in this module and provides links to specific configuration information.

Finding feature information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the “Feature Information for Configuring MAC Authentication Bypass” section.

How to configure configuring mac authentication bypass

This section contains the following tasks:

•Enabling MAC Authentication Bypass •Enabling Standalone MAB •Enabling Reauthentication on a Port •Specifying the Security Violation Mode

Information about configuring mac authentication bypass

•Overview of the Cisco IOS Auth Manager •Standalone MAB

Overview of the cisco ios auth manager

The capabilities of devices connecting to a given network can be different, thus requiring that the network support different authentication methods and authorization policies. The Cisco IOS Auth Manager handles network authentication requests and enforces authorization policies regardless of authentication method.

The possible states for Auth Manager sessions are as follows:

•

Prerequisites

Before you can configure standalone MAB, the switch must be connected to a Cisco Secure ACS server and RADIUS authentication, authorization, and accounting (AAA) must be configured.

Prerequisites for configuring mac authentication bypass

IEEE 802.1x—Port-Based Network Access Control

Restrictions

Standalone MAB can be configured on switched ports only—it cannot be configured on routed ports.

Security configuration guide, cisco ios release 15.2(7)ex (catalyst 2960-l switches) – mac authentication bypass [support]

Specifying the security violation mode

When there is a security violation on a port, the port can be shut down or traffic can be restricted. By default, the port is shut down. You can configure the period of time for which the port is shut down.

Summary steps

1. enable 2. configureterminal 3. interface typeslot/port 4. switchport 5. switchportmodeaccess 6. authentication port-control auto 7. mab [eap] 8. authentication violation {restrict | shutdown} 9. authentication timer restart seconds 10. end