The figure below illustrates a typical scenario in which VPN access control using 802.1X authentication is in place.

Figure 1

Typical 802.1X Authentication Setup

In the figure above, all the PCs are 802.1X capable hosts, and the Cisco router is an authenticator. All the PCs are connected to the built-in hub or to an external hub. If a PC does not support 802.1X authentication, MAC-based authentication is supported on the Cisco router. You can have any kind of connectivity or network beyond the Cisco router WAN.

Note	If there is a switch located between the router and the supplicant (client PC), the EAPOL frames will not reach the router because the switch discards them.

• A supplicant is an entity at one end of a point-to-point LAN segment that is being authenticated by an authenticator that is attached to the other end of that link.

The Cisco IOS commands in Cisco IOS Release 12.4(6)T for 802.1X authenticators have been standardized to work the same way on various Cisco IOS platforms.

There are deployment scenarios in which a network device (a router acting as an 802.1X authenticator) is placed in an unsecured location and cannot be trusted as an authenticator. This scenario requires that a network device be able to authenticate itself against another network device. The 802.1X supplicant support functionality provides the following solutions for this requirement:

• An Extensible Authentication Protocol (EAP) framework has been included so that the supplicant has the ability to "understand" and "respond" to EAP requests. EAP-Message Digest 5 (EAP-MD5) is currently supported.
• Two network devices that are connected through an Ethernet link can act as a supplicant and as an authenticator simultaneously, thus providing mutual authentication capability.
• A network device that is acting as a supplicant can authenticate itself with more than one authenticator (that is, a single port on a supplicant can be connected to multiple authenticators).

The following illustration is an example of 802.1X supplicant support. The illustration shows that a single supplicant port has been connected to multiple authenticators. Router A is acting as an authenticator to devices that are sitting behind it on the LAN while those devices are acting as supplicants. At the same time, Router B is an authenticator to Router A (which is acting as a supplicant). The RADIUS server is located in the enterprise network.

When Router A tries to authenticate devices on the LAN, it needs to "talk" to the RADIUS server, but before it can allow access to any of the devices that are sitting behind it, it has to prove its identity to Router B. Router B checks the credential of Router A and gives access.

Figure 2

Multiple Instances of Supplicant Support

The Cisco IOS commands in Cisco IOS Release 12.4(6)T for 802.1X supplicants have been standardized to work the same way on various Cisco IOS platforms. See the Configuring a Router As an 802.1X Supplicant module.

1.    enable

2.    configure terminal

3.    aaa new-model

4.    aaa authentication dot1x {default | listname} method1 [method2...]

5.    dot1x system-auth-control

6.    identity profile default

7.    interface type slot / port

8.    dot1x port-control auto

Router# configure terminal
Router(config)# aaa new-model
Router(config)# aaa authentication dot1x default group radius group radius
Router(config)# dot1x system-auth-control
Router(config)# interface fastethernet 1
Router(config-if)# dot1x port-control auto

Router# show dot1x all
Sysauthcontrol              Enabled
Dot1x Protocol Version            2
Dot1x Info for FastEthernet1
-----------------------------------
PAE                       = AUTHENTICATOR
PortControl               = AUTO
ControlDirection          = Both 
HostMode                  = MULTI_HOST
ReAuthentication          = Enabled
QuietPeriod               = 600
ServerTimeout             = 60
SuppTimeout               = 30
ReAuthPeriod              = 1800 (Locally configured)
ReAuthMax                 = 2
MaxReq                    = 3
TxPeriod                  = 60
RateLimitPeriod           = 60

1.    enable

2.    configure terminal

3.    ip radius source-interface interface-name

4.    radius-server host {hostname | ip-address}

5.    radius-server key string

Router# configure terminal
Router(config)# ip radius source-interface ethernet1
Router(config)# radius-server host 192.0.2.1
Router(config)# radius-server key radiuskey

1.    enable

2.    configure terminal

3.    interface type slot / port

4.    dot1x max-req number-of-retries

5.    dot1x port-control [auto| force-authorized| force-unauthorized]

6.    dot1x control-direction {both | in}

7.    dot1x reauthentication

8.    dot1x timeout tx-period seconds

9.    dot1x timeout server-timeout seconds

10.    dot1x timeout reauth-period seconds

11.    dot1x timeout quiet-period seconds

12.    dot1x timeout ratelimit-period seconds

Router# configure terminal

Router(config)# interface FastEthernet1

Router(config-if)# dot1x port-control auto

Router(config-if)# dot1x reauthentication

Router(config-if)# dot1x timeout reauth-period 1800

Router(config-if)# dot1x timeout quiet-period 600

Router(config-if)# dot1x timeout supp-timeout 60

Router(config-if)# dot1x timeout server-timeout 60

1.    enable

2.    configure terminal

3.    identity profile default

4.    description line-of-description

5.    template virtual-template

6.    device [authorize | not-authorize] mac-address mac-address

7.    device authorize type device-type

Router# configure terminal

Router (config)# identity profile default

Router(config-1x-prof)# description put the description here

Router(config-1x-prof)# template virtual-template1

Router(config-1x-prof)# device authorize type cisco ip phone

Router(config-1x-prof)# device authorize mac-address 0001.024B.B4E7

1.    enable

2.    configure terminal

3.    identity profile default

4.    description description-string

5.    template virtual-template

6.    exit

1.    ip dhcp pool name

2.    network network-number [mask]

3.    default-router address

1.    ip dhcp pool name

2.    network network-number [mask]

3.    default-router address

4.    exit

1.    configure terminal

2.    interface type slot / port

3.    ip address ip-address mask [secondary]

4.    interface virtual-template number

5.    ip address ip-address mask [secondary]

6.    exit

1.    enable

2.    configure terminal

3.    interface type slot / port

4.    ip unnumbered type number

Router(config)# identity profile default
Router(config-identity-prof)# description put the description here
Router(config-identity-prof)# template virtual-template1
Router(config-identity-prof)# exit
Router(config)# ip dhcp pool private
Router(dhcp-config)# default-router 192.0.2.0
Router(dhcp-config)# exit
Router(config)#ip dhcp pool public
Router(dhcp-config)# default-router 192.0.2.1
Router(dhcp-config)# exit
Router(config)# interface
Router(dhcp-config)# network 209.165.200.225 255.255.255.224
Router(dhcp-config)# default-router 192.0.2.1
Router(dhcp-config)# exit
Router(config)# interface loopback0
Router(config-if)# interface ethernet0
Router(config-if)# ip address 209.165.200.226 255.255.255.224
Router(config-if)# exit
Router(config)# interface virtual-template1
Router(config-if)# ip unnumbered loopback 0

802.1X authentication separates traffic from authenticated and unauthenticated devices. Traffic from authenticated devices transit through the physical interface, and unauthenticated traffic transits through the Virtual-Template1. Therefore, different policies can be applied on each interface. The configuration will also depend on whether two DHCP pools or a single DHCP pool is being used. If a single DHCP pool is being used, access control can be configured on Virtual-Template1, which will block any traffic from going to the networks to which unauthenticated devices should not have access. These networks (to which unauthenticated devices should not have access) could be the corporate subnetworks protected by the VPN or encapsulated by generic routing encapsulation (GRE). There can also be access control that restricts the access between authenticated and unauthenticated devices.

If two pools are configured, the traffic from a non-trusted pool is routed to the Internet using Network Address Translation (NAT), whereas trusted pool traffic is forwarded through a VPN tunnel. The routing can be achieved by configuring ACLs used by NAT and VPN accordingly.

For an example of an access control policy configuration, see the Access Control Policies Example section.

1.    Enable 802.1X for MD5.

2.    Enable DHCP.

802.1X implementation on a Windows 2000/XP PC is unstable. A more stable 802.1X client, AEGIS (beta) for Microsoft Windows, is available at the Meetinghouse Data Communications website at www.mtghouse.com.

1.    Make sure that the PC has at least Service Pack 3.

2.    Reboot your PC after installing the client.

3.    Go to the Microsoft Windows registry and add or install the following entry:

4.    Reboot your PC.

1.    Go to the Microsoft Windows registry and install the following entry there:

2.    Reboot your PC.

1.    Open the Network and Dial-up Connections window on your computer.

2.    Right-click the Ethernet interface (Local Area Connection) to open the properties window. It should have a tab called "Authentication."

Figure 3

Local Area Connection Properties Window

Use the debug commands in the Monitoring VPN Access Control Using 802.1X Authentication section to debug the supplicant.