Network Requirements
- PC is connected to IP Network via Device; Device enables the 802.1X access control;
- Authentication mode adopts RADIUS authentication.
- PC1 gets the IP address via the specified DHCP server, and then can access IP Network.
- After being configured to carry the static IP address authentication, PC2 cannot access IP Network.
Network Topology
![Networking of configuring 802.1X IP authorization DHCP Server mode](/storage/images/Document/Maipu/security/802.1x-ip-authorization.jpg)
Figure 12-10 Networking of configuring 802.1X IP authorization DHCP Server mode
Configuration Steps
Step 1: Configure the link type of the VLAN and interface on Device.
#Create VLAN2 and VLAN4 on Device, configure the port link type as Hybrid on gigabitethernet0/2, permit the services of VLAN2 to pass and configure PVID as 2.
Device#configure terminal
Device(config)#vlan 2,4
Device(config)#intergice gigabitethernet 0/2
Device(config-if-gigabitethernet0/2)#switchport mode hybrid
Device(config-if-gigabitethernet0/2)#switchport hybrid untagged vlan 2
Device(config-if-gigabitethernet0/2)#switchport hybrid pvid vlan 2
Device(config-if-gigabitethernet0/2)#exit
|
#On gigabitethernet0/5 of Device, configure the port link type as Access, permit the services of VLAN2 to pass (omitted).
#Configure the port link type as Access on gigabitethernet0/4 of Device, permit the services of VLAN4 to pass (omitted).
Step 2: Configure the interface IP address of Device.
#Configure the IP address of VLAN4 as 130.255.167.1/24.
Device(config)#intergice vlan 4
Device(config-if-vlan4)#ip address 130.255.167.1 255.255.255.0
Device(config-if-vlan4)#exit
|
Step 3: Configure the AAA authentication.
#Enable the AAA authentication on Device, adopt the RADIUS authentication mode, the server key is admin, the priority is 1, and the RADIUS server address is 130.255.167.167/24.
Device(config)#domain system
Device(config-isp-system)# aaa authentication dot1x radius-group radius
Device(config-isp-system)#exit
Device(config)#aaa server group radius radius
Device(config-sg-radius-radius)#server 130.255.167.167 priority 1 key admin
|
Step 4: Configure the AAA server.
#On the AAA server, configure the user name and password and key value as admin (omitted).
Step 5: Configure the DHCP server.
#On the DHCP server, configure the distributed IP address segment as 199.0.0.2-199.0.0.10 and the subnet mask as 255.255.255.0 (omitted).
Step 6: Enable the DHCP Snooping function on Device and configure the port gigabitethernet0/5 of Device as trust port.
Device(config)#dhcp-snooping
Device(config)#intergice gigabitethernet 0/5
Device(config-if-gigabitethernet0/5)#dhcp-snooping trust
Device(config-if-gigabitethernet0/5)#exit
|
Step 7: Configure the 802.1X authentication on Device.
#Enable the 802.1X authentication of gigabitethernet0/2.
Device(config)#intergice gigabitethernet 0/2
Device(config-if-gigabitethernet0/2)#dot1x port-control enable
Device(config-if-gigabitethernet0/2)#exit
|
#Configure the IP authorization of gigabitethernet0/2 as DHCP server mode.
Device(config)#intergice gigabitethernet 0/2
Device(config-if-gigabitethernet0/2)#dot1x authorization ip-auth-mode dhcp-server
Device(config-if-gigabitethernet0/2)#exit
|
#Enable the ARP keepalive of gigabitethernet0/2.
Device(config)#intergice gigabitethernet 0/2
Device(config-if-gigabitethernet0/2)#dot1x client-probe enable
Device(config-if-gigabitethernet0/2)#exit
|
Step 8: Check the result.
#PC1 user can authenticate successfully and can get the IP address from the DHCP server and access IP Network.
Device#show dot1x user
------------------------------------
NO 1 : MAC_ADDRESS= 3883.45ef.7984 STATUS= Authorized USER_NAME= admin
VLAN= 2 INTERFACE= gi0/2 USER_TYPE= DOT1X
AUTH_STATE= AUTHENTICATED BACK_STATE= IDLE IP_ADDRESS= 199.0.0.3
IPV6_ADDRESS= Unknown
Online time: 0 week 0 day 0 hours 0 minutes 36 seconds
Total: 1 Authorized: 1 Unauthorized/guest/critical: 0/0/0 Unknown: 0
#After PC2 user authenticates, it is in the GET-IP state and cannot get the IP address.
NO 1 : MAC_ADDRESS= 3883.45ef.f381 STATUS= Unauthorized USER_NAME= admin
VLAN= 2 INTERFACE= gi0/2 USER_TYPE= DOT1X
AUTH_STATE= GET_IP BACK_STATE= IDLE IP_ADDRESS= Unknown
IPV6_ADDRESS= Unknown
Online time: 0 week 0 day 0 hour 0 minute 34 seconds
Total: 1 Authorized: 0 Unauthorized/guest/critical: 1/0/0 Unknown: 0
#After checking, PC2 cannot access IP Network.