Cisco Wired Layer 2 Integration (2960X/XR)

Note – In this example the NAC RADIUS Server / Policy Server is 10.10.10.10 (replace this IP with the IP of your NAC system)

Note – Replace the VLAN number on the example port configuration with the desired default VLAN for the port.

Note – The “radius-server vsa send authentication” command is enabled by default and auto-generated on some IOS

versions. If the command does not show up in a sh run, “sh run all” can be used to verify that it is configured on the

switch.

Layer 3 DHCP prerequisites

interface vlanX (Layer 3 interface for enforced network)

ip helper-address X.X.X.X (DHCP server)

ip helper-address X.X.X.X (IP address of NAC Enforcer)

End

Layer 2 Switch Configuration

aaa new-model

aaa authentication dot1x default group radius

aaa authorization network default local group radius

aaa accounting dot1x default start-stop group radius

aaa session-id common

aaa accounting update newinfo periodic 10

aaa server radius dynamic-author

client 10.10.10.10 server-key XXXXX

port 3799

auth-type any

dot1x system-auth-control

ip device tracking

interface GigabitEthernetX/X/X (replace with interface number)

description NAC User Test Port

switchport access vlan X (replace with desired default VLAN for port)

switchport mode access

ip access-group sc_initial_acl in

authentication port-control auto

mab

dot1x pae authenticator (only required if endpoints are configured for 802.1X)

dot1x timeout tx-period 15

Last updated on

Was this page helpful?