0

I'm thinking of using our Cisco 3750 switch with our RADIUS server for 802.1x authentication on our Ethernet ports.

If I enable 802.1x and a user connects a switch to their Ethernet jack, and the first workstation connects and passes authentication successfully, will any workstations connected to the switch after authentication also be allowed to pass traffic, or can you configure the 3750 to prompt the new workstation for credentials, while still passing traffic to the first workstation that authenticated successfully?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 4:39
1

Any 802 compliant switch will not forward EAPOL. So, the cascaded switch would have to have its own 802.1x client to enable traffic to the upstream switch. (I am unaware of any commercially available switch with this feature)

802.1x only authorizes the physical port to pass traffic. It does not limit the MACs allowed to pass through the port -- that's where port security steps in.

When you enable port security and 802.1x authentication on a port, 802.1x authentication authenticates the port, and port security manages network access for all MAC addresses, including that of the client. You can then limit the number or group of clients that can access the network through an 802.1x port.

Catalyst 3750 Software Configuration Guide

1

You need to remove 802.1X authentication from inter-switch links.

802.1X is a port authentication protocol for clients and should be used on edge/access ports only that connect to a single client. If your access switch(es) don't support 802.1X you can't use it.

802.1X is a means to secure port access when its other end is exposed e.g. in a freely accessible workspace. Ports to other switches or devices should be secured by other means, usually by a locked cabinet or closet.

Non-compliant "dumb" switches or repeater hubs break 802.1X so that a single authenticating client on the switch/hub opens the port (and the whole switch/hub) for any traffic. Note that 802.1X can be circumvented quite easily that way when used as only port security measure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.