Solved

Cisco Dot1x Monitor Mode

Posted on 2014-03-02
5
1,058 Views
Last Modified: 2014-03-04
Hello All,

Our 802.1X testbed setup is connected to our Active Directory DC and appears to be set up
correctly and working fine.  We are using machine authentication using PEAP .  Supplicants are successfully authenticating when trying to connect to the network.

My question is,  what commands in addition to "Authentication Open" do I need to place on
Cisco 3750X and 3750G switches running IOS version 1502 into "monitor mode"?

Also,  once the port\interface is configured for monitor mode,  will the ACS 5X server generate radius logs if the SUPPLICANT SUCCESSFULLY AUTHENTICATES or does it only
generate a radius log if there are authentication issues?

And finally.  When I issue the "Show dot1x interface xxx",  commnad,  I am not seeing anything in the output when I try to use monitor mode.

Thanks in advance.

ray
0
Comment
Question by:Rayneedssomehelp
  • 3
  • 2
5 Comments
 
LVL 45

Accepted Solution

by:
Craig Beck earned 500 total points
Comment Utility
This should be all you need on a switchport to enable monitor mode (assuming you've already configured global 802.1x settings...

 interface range GigabitEthernet1/0/1 - 10
  authentication open
  authentication port-control auto
  dot1x pae authenticator
  mab
  authentication host-mode multi-auth

Open in new window


The RADIUS logs will show successes and failures.
0
 
LVL 45

Expert Comment

by:Craig Beck
Comment Utility
I 'think' that you don't see anything when you use the 'Show dot1x interface xxx' command because you're only able to see accounting messages, not authentications at the switch.  To see authentications you need to check the RADIUS Authentication logs in the ACS.
0
 

Author Comment

by:Rayneedssomehelp
Comment Utility
The only commands I had on the interface was Authentication Open and Authentication host-mode multi-auth.

Does not the "Show dot1x interface xxx" command tell you if the port is enabled for the
Dot1X protocol?  Which of the commands  aformentioned will actually enable 802.1x  on
a switch interface assuming that global configs are already correct?

Ray
0
 
LVL 45

Expert Comment

by:Craig Beck
Comment Utility
show authentication session interface gi1/0/1 will show you if authentication is working on the port.

If it is you'll see something like this...

sh authent sess int g1/0/1
            Interface:  GigabitEthernet1/0/1
          MAC Address:  0040.9668.9896
           IP Address:  Unknown
               Status:  Authz Success
               Domain:  DATA
       Oper host mode:  multi-domain
     Oper control dir:  both
        Authorized By:  Authentication Server
          Vlan Policy:  10
      Session timeout:  N/A
         Idle timeout:  N/A
    Common Session ID:  0000000000000AAAAAAAAAAA
      Acct Session ID:  0x00000CCB
               Handle:  0x2E000FF0
0
 

Author Comment

by:Rayneedssomehelp
Comment Utility
CRAIGBECK,

Thanks for clearing this up!  I think I was confused by the fact that apparently there are 2 different syntaxes for configuring Cisco switch interfaces for 802.1x...It depends on the IOS.
.
One starts with "Authentication" and the other starts off with "dot1x" in the syntax

I got confused because I did not know which ones to use.  I just configured as many commands as I could on the port until I got it to work and allow authentication.

Thanks again!

Ray
0

Featured Post

Free camera licenses with purchase of My Cloud NAS

Milestone Arcus software is compatible with thousands of industry-leading cameras for added flexibility. Upon installation on your My Cloud NAS, you will receive two (2) camera licenses already enabled in the software. And for a limited time, get additional camera licenses FREE.

Join & Write a Comment

Suggested Solutions

BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
It’s 2016. Password authentication should be dead — or at least close to dying. But, unfortunately, it has not traversed Quagga stage yet. Using password authentication is like laundering hotel guest linens with a washboard — it’s Passé.
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now