Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

IOS doesn't accept dot1x commands on 4510r+e

I am running a 4510 with a SUP-8. I am trying to implement 802.1x for NAC, but the switch refuses the interface-level command. Below is the entire config I am trying to implement and the results. Any ideas as to why it rejects the interface level commands?

! dot1x
aaa authentication dot1x   default group radius
aaa authorization network   default group radius
aaa authorization auth-proxy   default group radius
aaa accounting dot1x default   start-stop group radius
aaa accounting network   default start-stop group radius
aaa accounting system default   start-stop group radius
aaa accounting update   periodic 15
aaa accounting update newinfo
radius-server attribute 6   on-for-login-auth
radius-server attribute 8   include-in-access-req
radius-server attribute 25   access-request include
radius-server dead-criteria   time 30 tries 3
radius server ISE
address ipv4 10.40.0.2 auth-port 1812   acct-port 1813
address ipv4 10.40.0.4 auth-port 1812   acct-port 1813
key 0 xxxxxxxxxxxx
radius-server vsa send   accounting
radius-server vsa send   authentication
ip radius source-interface   Vlan500
!
ip arp inspection vlan 15
ip dhcp snooping vlan 15
no ip dhcp snooping information option
ip dhcp snooping
ip device tracking
!
dot1x system-auth-control
dot1x critical eapol

!

interface g1/5

switchport access vlan 15
switchport voice vlan 65
logging event link-status
service-policy input QoS-Input-Policy
service-policy output   QoS-Host-Port-Output-Policy
authentication event fail action next-method
authentication event server dead action   authorize vlan 1500
authentication event server alive action   reinitialize
authentication host-mode multi-auth
authentication open
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication timer reauthenticate server
authentication periodic
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 10

LAB-IDF(config)#int g1/5

LAB-IDF(config-if)# switchport access vlan 15

LAB-IDF(config-if)# switchport voice vlan 65

LAB-IDF(config-if)# logging event link-status

LAB-IDF(config-if)# service-policy input QoS-Input-Policy

% policy map QoS-Input-Policy not configured

LAB-IDF(config-if)# service-policy output QoS-Host-Port-Output-Policy

% policy map QoS-Host-Port-Output-Policy not configured

LAB-IDF(config-if)#

LAB-IDF(config-if)# authentication event fail action next-method

                       ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)#$tion event server dead action authorize vlan 1500       

                       ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)# authentication event server alive action reinitialize

                       ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)# authentication host-mode multi-auth

                       ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)# authentication open

                       ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)# authentication order mab dot1x

                       ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)# authentication priority dot1x mab

                       ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)# authentication port-control auto

                       ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)# authentication timer reauthenticate server

                       ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)# authentication periodic

                       ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)# authentication violation restrict

                       ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)# mab

                      ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)# dot1x pae authenticator

                        ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)# dot1x timeout tx-period 10

                        ^

% Invalid input detected at '^' marker.

LAB-IDF(config-if)#!

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Blue

IOS doesn't accept dot1x commands on 4510r+e

Josh

Can you add this to the port config -

int gi1/5

switchport mode access

Jon

4 REPLIES
New Member

IOS doesn't accept dot1x commands on 4510r+e

Edit: I do know that the 'authentication' command shows as if it's not available under interface mode. I was wondering if there was maybe something else I have to turn on first before it's avaliable. Also, in the configuration guide, it says there shoudl be a 'dot1x' command in interface mode, but it's not there either.

Hall of Fame Super Blue

IOS doesn't accept dot1x commands on 4510r+e

Josh

Can you add this to the port config -

int gi1/5

switchport mode access

Jon

New Member

IOS doesn't accept dot1x commands on 4510r+e

Thanks Jon, that solved the issue. I was thinking that 'switchport access vlan x' was enough to set the port to access. Thanks.

Hall of Fame Super Silver

Hi Jon,+5 two years later - I

Hi Jon,

+5 two years later - I missed this one on a switch I was working on and found your answer.

546
Views
10
Helpful
4
Replies
CreatePlease to create content