802.1x接入配置指南.docVIP

802．1x接入配置指南 一、Cisco交换机的802.1x接入配置 采用CISCO 3560G作为802.1x 接入设备，以EAP-MD5认证业务为例，IEEE 802.1x认证配置。 组网： 配置： Step 1 Enter Global configuration mode(进入全局模式) Switchenable Password: cisco Switch#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# Step 2 Enable AAA(启用AAA) Switch(config)#aaa new-model Step 3 Create IEEE 802.1x Authenticatin Method List(创建802.1x认证方法列表) Switch(config)#aaa authentication dot1x default group radius Step 4 Enable IEEE 802.1x authentication globally in the Switch (启用全局802.1x认证） Switch(config)#dot1x system-auth-control Step 5 (Optional) Configure the switch to use user-RADIUS authorization for all network-related service requests, such as per-user ACLs or VLAN assignment（创建授权网络列表） Switch(config)#aaa authorization network default group radius Step 6 (Optional) Specify the IP address of the RADIUS server（配置radius服务器信息包括配置配置radius认证与计费共享密钥secospace） Switch(config)#radius-server host 36 auth-port 1812 acct-port 1813 key secospace Step 7 Enter interface configuration mode(进入接口配置模式，启用802.1x接入功能） Switch(config)#interface gigabitEthernet 0/1 /* Set the port to access mode only if you configured the RADIUS server in Step 6 and Step 7 */ Switch(config-if)#switchport mode access /* Enable IEEE 802.1x authentication on the port */ Switch(config-if)#dot1x port-control auto Step 8 Return to privileged EXEC mode (返回特权模式) Switch(config-if)#end Step 9 Verify your entries（验证802.1x配置） Switch#show dot1x Step 10 (Optional) Save your entries in the configuration file （保存配置文件） Switch#copy running-config startup-config To display IEEE 802.1x statistics for all ports (查看所有端口状态) Swtch#show dot1x all [details | statistics | summary] To display IEEE 802.1x statistics for a specific port（查看指定端口状态） Swtch#show dot1x interface interface-id [statistics | details] [上行接口与Access口对接] ! interface GigabitEthernet0/23 switchport access vlan 10 switchport