Cisco CCNP Security Core (SCOR) 350-701Endpoint Security and Secure Network AccessMedium
A network security administrator is configuring 802.1X authentication on a Cisco Catalyst switch. The goal is to allow endpoints to connect only after successful authentication against a RADIUS server. Which command sequence would correctly enable 802.1X port-based authentication on a specific interface and specify the authentication method list?
- Ainterface GigabitEthernet0/1 authentication port-control auto dot1x pae authenticator dot1x timeout tx-period 10 aaa authentication dot1x default group radius
- Binterface GigabitEthernet0/1 dot1x port-control auto dot1x pae authenticator authentication pre-authenticate aaa authentication dot1x default group radius
- Cinterface GigabitEthernet0/1 authentication host-mode multi-auth dot1x pae authenticator dot1x port-control auto aaa authentication dot1x default group radius
- Dinterface GigabitEthernet0/1 authentication port-control auto dot1x pae authenticator aaa authentication dot1x default group radius dot1x host-mode multi-domain
Show answer & explanationAnswer & explanation
Correct answer: A. interface GigabitEthernet0/1 authentication port-control auto dot1x pae authenticator dot1x timeout tx-period 10 aaa authentication dot1x default group radius
The command `authentication port-control auto` enables 802.1X on the interface, `dot1x pae authenticator` sets the switch as the authenticator, and `aaa authentication dot1x default group radius` specifies the RADIUS server for authentication. The `dot1x timeout tx-period` is a common configuration for 802.1X.
Why the other options are wrong
- B. `authentication pre-authenticate` is not a standard command for enabling 802.1X on an interface; `dot1x port-control auto` or `authentication port-control auto` is needed.
- C. `authentication host-mode multi-auth` is a host mode, but the primary command to enable 802.1X is `authentication port-control auto` or `dot1x port-control auto`.
- D. `dot1x host-mode multi-domain` is a host mode setting, not the core command to enable 802.1X authentication on the port.
802.1X Port Configuration
Commands required on a Cisco Catalyst switch interface to enable and configure IEEE 802.1X port-based authentication.
- Requires AAA configuration for authentication methods.
- Uses `authentication port-control auto` or `dot1x port-control auto` for enablement.
- Switch acts as the Authenticator PAE (Port Access Entity).
Memory trick: To make the port 'smart', enable control, set PAE, and point to AAA.