Basic 802.1X Port Configuration on Cisco IOS XE Switches
A complete 802.1X switchport config on IOS XE 17.9: AAA, RADIUS servers, dot1x system-auth-control, interface policy-map, and the voice VLAN gotchas to avoid.
Archive
Latest posts — page 65
802.1X Authentication Flow Step by Step: From EAPOL Start to RADIUS Accept
The 802.1X authentication flow, step by step, from EAPOL-Start through RADIUS Access-Accept and port authorization. Three conversations, one timeline, no magic.
Introduction to Cisco ISE: What It Is and Why It Matters for 802.1X
Cisco ISE is more than a RADIUS server. It is the policy decision point for 802.1X, layering device type, posture, and context on top of pass/fail authentication.
Change of Authorization (CoA) in 802.1X: How It Works and How to Configure It
RADIUS CoA lets ISE push policy updates to the switch mid-session, no re-auth required. Here is the IOS XE and ISE config, plus the posture remediation use case.
Web Authentication as a Fallback in 802.1X: Configuration and Use Cases
Web authentication adds a captive portal as an 802.1X fallback for guests, contractors, and unmanaged endpoints. Here is the Cisco IOS XE and ISE config.
802.1X with IP Phones: Configuring Multi-Domain Authentication on Cisco IOS XE
Multi-domain authentication lets an IP phone and a PC share one 802.1X port with separate voice and data VLANs. Here is the Cisco IOS XE config and verification.
Cisco dACL: Downloadable ACLs with ISE and 802.1X
A downloadable ACL is a name in the Access-Accept, not a policy. Here is the second RADIUS transaction that fetches it, and what the switch really applies.
Guest VLAN, Auth-Fail VLAN, and Critical VLAN in 802.1X: When and How to Use Them
Guest VLAN, Auth-Fail VLAN, and Critical VLAN cover the three 802.1X failure paths: no supplicant, wrong credentials, and RADIUS down. Here is when and how to use each.
Dynamic VLAN Assignment with 802.1X and Cisco ISE
Dynamic VLAN assignment returns the target VLAN in RADIUS Tunnel attributes, so identity (not cabling) decides the network segment. Here is the ISE and IOS XE config.
802.1X Authentication Host Modes: Single-Host, Multi-Host, Multi-Domain, Multi-Auth
Single-host, multi-host, multi-domain, and multi-auth control how many MACs can use an 802.1X port. Pick the wrong mode and you get silent failures or open ports.
Troubleshooting 802.1X with show authentication sessions and debug Commands
show authentication sessions is your first 802.1X diagnostic. Here is how to read the output, when to escalate to debug dot1x and debug radius, and how to stay sane.
dACL Not Applying Correctly in 802.1X: Troubleshooting Downloadable ACLs
dACL not applying usually means ISE sent the wrong AVPair name, the switch cannot download it, or the ACL content parsed badly. Here is the full troubleshooting path.