CLI Guide

Security Commands 1076
User Guidelines
It is recommended that you disable spanning tree or enable spanning-tree
portfast mode on 802.1x edge ports (ports in auto state that are connected to
end stations) in order to go immediately to the forwarding state after
successful authentication.
When configuring a port to use MAC-based authentication, the port must be
in switchport general mode.
Example
The following command enables MAC-based authentication on port 1/0/2
console(config)# interface gigabitethernet 1/0/2
console(config-if-Gi1/0/2)# dot1x port-control mac-based
authentication host-mode
Use the authentication host-mode command to configure the host mode of
an interface. Use the no form of the command to set the interface
configuration to the default.
Syntax
authentication host-mode { multi-auth | multi-domain | multi-host |
single-host | multi-domain-multi-host }
no authentication host-mode
• multi-auth—Allow multiple hosts to authenticate individually on the
interface.
• multi-domain—Allow one data device and one voice device to
authenticate.
• multi-host—Allow multiple hosts access to the network on an
authenticated interface. One host must authenticate on the interface to
allow access to other hosts.
• multi-domain-multi-host—Allow one data device and one voice device to
authenticate. Once the data device is authenticated, unrestricted access to
the data VLAN for any host is allowed.
• single-host—Allow a single authenticated device access to the network.