Configuring 802.1x

Information About 802.1x

IEEE 802.1X is the accessing management protocol standard based on interface accessing control passed in June, 2001. Traditional LAN does not provide accessing authentication. User can access the devices and resources in LAN when connecting to the LAN, which is a safety loophole. For application of mobile office and CPN, device provider hopes to control and configure users connecting. There is also the need for accounting.

IEEE 802.1X is a network accessing control technology based on interface, which is the accessing devices authentication and control by physical accessing level of LAN devices. Physical accessing level here means the interface of LAN Switch devices. When authenticating, Switch is the in-between (agency) of client and authentication server. It obtains users identity from client of accessing Switch and verifies the information through authentication server. If the authentication passes, this user is allowed to access LAN resources or it will be refused.

802.1x Authentication

802.1X operates in the typical client/server model and defines three entities: supplicant system, authentication system, and authentication server system:

  • Supplicant System: It is required to access the LAN, and enjoy the services provided by the Switch equipment (such as PC), the client needs to support EAPOL agreement, and the client must run the IEEE 802.1X authentication client software.

  • Authentication System: In the Ethernet system, the authentication Switch is mainly used to upload and deliver user authentication information and control whether the port is available according to the authentication result. As if between the client and the authentication server to act as a proxy role.

  • Authentication Server: Normally refers to the RADIUS server. RADIUS checks the identity of the client (user name and password) to determine whether the user has the right to use the network system to provide network services. After the end of the authentication, results will be sent to the Switch.

The above systems involve three basic concepts: PAE, controlled port, control direction:

  • PAE: Port Access Entity (PAE) refers to the entity that performs the 802.1x algorithm and protocol operations.

    PAE is the entity responsible for performing algorithms and protocol operations in the authentication mechanism. The PAE uses the authentication server to authenticate the clients that need to access the LAN, and controls the authorized / unauthorized status of the controlled ports accordingly according to the authentication result. The client PAE responds to the authentication request from the device and sends the user authentication information to the device. The client PAE can also send the authentication request and the offline request to the device.

  • Controlled port and uncontrolled port: An authenticator provides ports for supplicants to access the LAN. Each of the ports can be regarded as two logical ports: a controlled port and an uncontrolled port.

    • The uncontrolled port is always enabled in both the ingress and egress directions to allow EAPOL protocol frames to pass, guaranteeing that the supplicant can always send and receive authentication frames.

    • The controlled port is enabled to allow normal traffic to pass only when it is in the authorized state.

    • The controlled port and uncontrolled port are two parts of the same port. Any frames arriving at the port are visible to both of them.

  • Control direction: In the non-authorized state, the controlled port is set to one-way controlled: the implementation of one-way controlled, prohibits the receiving frame from the client, but allows the client to send frames.

  • Port controlled manner

    • Port-based authentication: As long as the first user authentication is successful under the physical ports, other access users without authentication can use the network source, when the first user is off line, other users will be refused to use network.

    • MAC-address-based authentication: All the users on the physical port need to be authenticated separately. When userA goes offline, only the userA cannot use the network.

802.1x Authentication Process

The 802.1x authentication system employs the Extensible Authentication Protocol (EAP) to exchange authentication information between the supplicant PAE, authenticator PAE, and authentication server.

At present, the EAP relay mode supports four authentication methods: EAP-MD5, EAP-TLS (Transport Layer Security), EAP-TTLS (Tunneled Transport Layer Security), and PEAP (Protected Extensible Authentication Protocol).

Switch supports EAP-Transfer mode and EAP-Finish mode to interactive with remote RADIUS server to finish the authentication.

  • Authentication Process: The following takes EAP-Transfer authentication process for an example to introduce the basic service procedure.

    The authentication process is as follows:

    • When the user needs to access the network, it will input the registered user name and password through the 802.1X client and initiate the connection request (EAPOL-Start packet). At this point, the client program sends the request message to the device, start an authentication process.

    • After receiving the requested data frame, the access device sends out a request frame (EAP-Request/Identity packet) to ask the user's client program for the user name.

    • The client responds to the request from the device and sends the user name information to the device through the data frame (EAP-Response/Identity packet). The device encapsulates the RADIUS Access-Request packet and then sends it to the authentication server for processing after receiving the data frame packet from the client.

    • After receiving the user name information from the device, the RADIUS server compares the information with the user name table in the database, finds the corresponding password information, and encrypts it with a randomly generated encryption key. And it sends the encrypted keyword to the device through a RADIUS Access-Challenge packet. The message is then forwarded by the device to the client.

    • After receiving the EAP-Request/MD5 Challenge packet, the client encrypts the encrypted part (this encryption algorithm is usually irreversible) and generates the EAP-Response/MD5 Challenge packets and pass the authentication packets to the authentication server.

    • The RADIUS server compares the received encrypted information (RADIUS Access-Request packet) with the local encrypted password information. If the password is the same, the RADIUS server considers the user to be a valid user and sends out the message-Accept and EAP-Success).

    • After receiving the authentication message, the device changes the port to the authorized state, allowing the user to access the network through the port.

  • EAP-Finsh: In this way, EAP packets are terminated at the device end and are mapped to RADIUS packets. The RADIUS server uses the standard RADIUS protocol to complete authentication, authorization, and accounting. The PAP or CHAP authentication method can be adopted between the device and the RADIUS server. Our Switch defaults to this mode. The following takes the CHAP authentication method as an example to describe the basic service flow, as shown below:

    The EAP termination mode differs from the authentication process of EAP relay mode in that a random encryption key for encrypting the user's password information is generated by the device, and then the device encrypts the user name, the random encryption key, and the encrypted password information of the client to the RADIUS server, and perform the related authentication process.

How to Configure 802.1x

This section provides information about how to configure 802.1x.

Configuring EAP

The 802.1x standard forwards the 802.1X authentication packets (Encapsulated with EAP frames) from the user to the RADIUS server without any processing. However, the traditional RADIUS server does not support the EAP feature. Therefore, the system supports the conversion of the authentication packets sent by the user to the data frames encapsulated by the standard RADIUS protocol and then forwards the packets to the RADIUS server.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. dot1x {eap-finish | eap-transfer}
  4. end

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

(Optional) Enters global configuration mode.

Step 3

dot1x {eap-finish | eap-transfer}

Example:

Device(config)# dot1x eap-transfer

Sets the protocol interaction mode between the system and the RADIUS server.

Step 4

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

Enabling 802.1x

802.1x provides a user identity authentication scheme. However, 802.1x cannot implement the authentication scheme solely by itself. RADIUS or local authentication must be configured to work with 802.1x.

After enabling the 802.1X, the users who connected to the system can access to the LAN resources only after it had passed the authentication. When enabling the 802.1X, you should point out the whether the enabling way is based on interface authentication or MAC address authentication. The interface which does not participate in 802.1X authentication has no need to enable 802.1X authentication.

Interface configuration based on interface authentication: if one of the users under the port had passed the authentication, other users can use the network resources without authentication; However, if that user who had passed the authentication logoff, other users can not be able to use the network resources.

Interface configuration based on MAC address authentication: each user under the port should perform separate authentication. Only the user who had passed the authentication can he use the network resources. If a certain user logoff, it cannot affect other authenticated users to use the network resources.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. dot1x method {macbased | portbased} [interface interface-type]
  4. end

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

(Optional) Enters global configuration mode.

Step 3

dot1x method {macbased | portbased} [interface interface-type]

Example:

Device(config)# dot1x method macbased

Enables 802.1x.

Step 4

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

Configuring 802.1x Parameters for a Port

After the interface enables the 802.1X authentication, this port needs to be authenticated by default while the uplink interface and the interface which connects to the server do not need, so you can configure the ports which do not need to be authenticated to be forceauthorized or disable their authentication functions. In addition, the interface which is banned to perform 802.1X authentication can be configured to be forceunauthorized.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. dot1x port-control {auto | forceauthorized | forceunauthorized} [interface interface-type]
  4. end

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

(Optional) Enters global configuration mode.

Step 3

dot1x port-control {auto | forceauthorized | forceunauthorized} [interface interface-type]

Example:

Device(config)# dot1x port-control forceauthorized

Configures 802.1x parameters for a port.

Step 4

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

Configuring Re-authentication

In EAP-FINISH way, the port supports re-authentication. After the user is authenticated, the port can be configured to immediately re-certification, or periodic re-authentication.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. dot1x {re-authenticate | re-authentication | timeout re-authperiod time} [interface interface-type]
  4. end

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

(Optional) Enters global configuration mode.

Step 3

dot1x {re-authenticate | re-authentication | timeout re-authperiod time} [interface interface-type]

Example:

Device(config)# dot1x re-authenticate

Enables reauthentication.

  • re-authenticate : Re-authenticates immediately.

  • re-authentication : Enables periodic re-authentication on a port.

  • timeout re-authperiod time : Enables periodic time configuration re-authentication on a port. The range is 1 to 3600.

Step 4

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

Configuring Watch Feature

After enabling this function, a port sends a 1x watch message periodically when no user is present, triggering the users to perform 802.1x authentication.

This triggering method is used to support clients that cannot send EAPOL-Start packets, such as 802.1X clients. Our device sends an EAP-Request/Identity packet to the client every N seconds to trigger authentication.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. dot1x daemon [interface interface-type | time time]
  4. end

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

(Optional) Enters global configuration mode.

Step 3

dot1x daemon [interface interface-type | time time]

Example:

Device(config)# dot1x daemon

Enables the watch function.

The time keyword configures the forwarding interval of watch packet.

Step 4

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

Configuring User Features

The operations mainly perform the operations, for example, the configurations for number of port users, delete users, heartbeat detection operations, etc.

Heartbeat detection: After this function is enabled, the device periodically forwards EAP-Request/Identity to the client ports, the normal online client responds with the EAP-Rsponse/Identity. If the four consecutive EAP-Request/Identity packets are not received the EAP-Rsponse/Identity packet from the client, the device considers the user to go offline, and then it will delete the session and change the port to an unauthorized state.

Quiesce function: After the user authentication fails, the device needs to quiesce for a period of time (The time can be configured through dot1x quiet-period-value. By default, no quiesced is required). During the quiesced period, the authenticator does not process the authentication request.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. dot1x max-user number
  4. dot1x user cut {mac-address address | username name}
  5. dot1x detect [interface interface-type | interval time]
  6. dot1x quiet-period-value time
  7. end

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

(Optional) Enters global configuration mode.

Step 3

dot1x max-user number

Example:

Device(config)# dot1x max-user 33

Configures the maximum number of users that can pass authentication. The range is 1 to 100.

Step 4

dot1x user cut {mac-address address | username name}

Example:

Device(config)# dot1x user cut username user12

Deletes the specified online user.

Step 5

dot1x detect [interface interface-type | interval time]

Example:

Device(config)# dot1x max-user 33

Configures the Heartbeat detection time.

The interval time range is 1 to 3600 seconds. The default is 25 seconds.

Step 6

dot1x quiet-period-value time

Example:

Device(config)# dot1x max-user 33

Configures the quiesce function.

The range is 0 to 600 seconds. The default is 0 second.

Step 7

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

Configuring Host Mode Based on Port Authentication Mode

The host mode configuration only takes effect in port authentication method, please configure the port as port-based authentication; if the configuration of the host mode is the single-host, configure the port to be mac-based authentication, host mode will automatically become invalid.

  • multi-hosts: Multi-hosts mode, when a user authentication is passed on the port, other users of the port can access network without authentication.

  • single-host: Single-host mode, the user access network which the port allows only one authentication to pass and other users cannot access to the network, also can't go through authentication.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. dot1x portbased host-mode {multi-hosts | single-host} [interface type]
  4. end

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

(Optional) Enters global configuration mode.

Step 3

dot1x portbased host-mode {multi-hosts | single-host} [interface type]

Example:

Device(config)# dot1x portbased host-mode

Configures host-mode based on port authentication mode.

Step 4

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

Configuring Guest VLAN

After enabling 1X authentication, the user can access only the network resources of the VLAN when the guest VLAN is configured on the port. Once the user authentication succeeds, the port automatically reverts to the previously configured VLAN. If the authentication server delivers a valid VLAN, the port is automatically added to the assigned VLAN. After the user goes offline, the port reverts to the guest VLAN.

To ensure that all functions can be used normally, please assign different VLAN IDs for the Config VLAN, the radius distribution VLAN, and the Guest VLAN.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. dot1x guest-vlan vlan-id [interface type]
  4. end

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

(Optional) Enters global configuration mode.

Step 3

dot1x guest-vlan vlan-id [interface type]

Example:

Device(config)# dot1x guest-vlan 120

Configures the guest VLAN. The range is 1 to 4094.

Step 4

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

Configuring Radius VLAN

When 802.1X user pass the authentication via radius server, the server transmits the authentication information to the device. If the device has enabled radius function and the server has configured to distribute VLAN (adopting Tunnel-Pvt-Group-ID (81) attribute), the authentication information includes the distributed VLAN information as a consequence, what is more, the device adds the user authentication online interface to radius distributed VLAN.


Note

Before using the radius VLAN distribution function, you should create the corresponding VLAN and then add the user interface to the corresponding VLAN, so does Guest VLAN and Default-active-vlan.

Radius distributes VLAN, but it does not change the interface original VLAN configuration, so does Guest VLAN and Default-active-vlan.

As to the interface-based authentication and the MAC-based authentication, radius vlan , Guest VLAN and Default-active-vlan are effective.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. aaa
  4. radius vlan enable
  5. end

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

(Optional) Enters global configuration mode.

Step 3

aaa

Example:

Device(config)# aaa

Enters Authentication, Authorization, and Accounting (AAA) configuration mode.

Step 4

radius vlan enable

Example:

Device(config-aaa)# radius vlan enable

Enables radius VLAN distribution function. This is disabled by default.

Step 5

end

Example:

Device(config-aaa)# end

Exits AAA configuration mode and returns to privileged EXEC mode.

Configuring EAPOL Transmission

When a port disables 802.1x authentication, it requires to transmit user 802.1x EAPOL message. So the equipment works as the relay, users can perform 802.1x authentication in the upper equipment. This function can only handle EAPOL packet forwarded to CPU. For packets that do not forward to CPU, the packets are processed by the hardware and are not subject to this configuration. You can configure EAPOL transparent transmission port and the corresponding uplink port only when the 802.1x authentication is disabled. That is, you cannot configure transparent transmission function when the 802.1x authentication is enabled.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. dot1x eapol-relay [interface type | uplink]
  4. end

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

(Optional) Enters global configuration mode.

Step 3

dot1x eapol-relay [interface type | uplink]

Example:

Device(config)# dot1x eapol-relay

Enables port EAPOL message transmission function.

Step 4

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

Monitoring 802.1x

This section provides the list of commands that are used to monitor the 802.1x configuration. Run the commands in the following table in global configuration mode:

Command Purpose

show dot1x

Displays the status of 802.1x authentication function.

show dot1x daemon

Displays the configuration of 802.1x authentication interface watch function .

show dot1x interface

Displays interface configuration, such as the interface control mode, re-authentication state, the maximum number of users for the interface authentication.

show dot1x session

Displays 802.1x session.

show dot1x eapol-relay

Displays EAPOL pass through configuration.

show dot1x detect

Displays heartbeat detection configuration.

show dot1x guest-vlan

Displays guest VLAN information.

show dot1x port-auth

Displays whether the interface authentication is enabled or disabled.

show dot1x quiet-period-value

Displays the quiet period.

debug dot1x

Debugs dot1x receive packet and transmit packet as well as module processing.

Configuration Examples for 802.1x

This section provides configuration examples for 802.1x.

The following example shows how to enable the 802.1x authentication of Ethernet port 1/1.

Device> enable
Device# configure terminal
Device(config)# dot1x method macbased interface ethernet 1/1

This example shows how to configure the basic function of RADIUS server.

Device> enable
Device# configure terminal
Device(config)# aaa
Device(config-aaa)# radius host 1
Device(config-aaa-radius-1)# primary-auth-ip 10.1.1.1 1812
Device(config-aaa-radius-1)# primary-acct-ip 10.1.1.2 1813
Device(config-aaa-radius-1)# auth-secret-key 123456
Device(config-aaa-radius-1)# acct-secret-key 123456
Device(config-aaa-radius-1)# exit
Device(config-aaa)# domain abc.com
Device(config-aaa-domain-abc.com)# radius host binding 1
Device(config-aaa-domain-abc.com)# state active
Device(config-aaa)# default domain-name enable abc.com

The following is a sample output of the show dot1x session command. 

Device(config)# show dot1x session

port    vid    mac             username      login time
1/1     1      2001:DB8::1     u1@abc.com    2000/01/01 05:13:42