802.1x Blocking port (many deviсes to one port)

Hello!
On ports of the Cisco 3750 there is authentication on 802.1x (Mab). I connect the "stupid" switch (that doesn't work with 802.1x) to port and logs of Radius-server and Cisco show that it was authenticated. Then I connect the device (laptop or PC) to the "stupid" switch, then the port is blocked. However PC passes authentication at direct connection to the Cisco.
I know that in 802.1x is provided blocking of port at connection of many MAC-addresses to one port.
"Stupid" switch must be in vlan, and the devices (that are connected to switch) must be in the same vlan. Maybe they must be authenticated on Radius-server or maybe I have to create ACL with their MAC-addresses...
How it can be solved? Help me, please.
P.S. Multi-auth is enabled.

Hi,
Along with all the other bits and pieces to invoke 802.1x on the switch
May be try adding this to the interface to "stupid"
interface gigabitethernet2/0/1
description *** LINK TO STUPID ***
dot1x port-control auto
dot1x host-mode multi-host
end
from the 12.2.55 config guide
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/configuration/guide/scg3750/sw8021x.html#wp1271507
Regards
Alex

Similar Messages

How can I write to port C and read from port A&B simultaneously using 6503 DIO-24

I attempting to read from Port A and B which are grouped together and at the same time I want to write to Port C. The problem I having now is that every time I want to read from Port A and B, Port C seems to be effected. I have only used the easy dio's vi this may be the root of my prblem

Hello,
You will need to use the advanced digital VIs to accomplish what you are trying to do.
The Easy DIO VI's are simply a combination of two DIO advanced VI, so you will use the same two advanced VI with a little different calling method. We want to call both PORT Config VI first to configure two ports for read and one port for write. Then we can simply read and write to the ports as desired, perhaps in a loop.
The best place to start would be to look at the LabVIEW examples for Digital Input and Output operations. In LabVIEW, go to Search Examples then under I/O interfaces select DAQ (or Data Acquisition)-> Digital Input and Output->Immediate Digital Input and Output. From her you will want to look at the examples under the 8255 chip which is the chip on
the DIO-24. I would recommend looking at Read from two digtial ports and the Write to one digital port VI's.
From here you will simply need to combine the two together. One note: you will want to make sure that both port config VI are called before either Port Read or Port Write VIs.

How many sockets can be opened to one port

Hi All,
There is a service installed on port 4444 of our server. In order to do some work with that service we open sockets to it with socket:localhost:4444. The thing we are finding is that it is quiet expensive to initialise these socket connections per request to our website and I'd like to pool connections. I have implemented a pool but currently this closing the connection when returning to the pool. I would actually like them to stayalive in the pool but I do not know if I can have many sockets open to one port?
Thanks!

You are unlikely to get an exact answer.
The first limit you'll probably run into is the number of file descriptors that can be open at a time. This depends on your OS and configured per-process limits.
Socket buffers use memory. Amount of memory, allowed process size (if your OS enforces that with in-kernel buffers), and size of send/receive buffers give another limit.
Other OS-dependent limits, such as a max global file descriptor count, may exist.
TCP/IPv4 (if you use that) connections are defined by a 4-tuple {source address, source port, destination address, destination port}. As long as source address&port are unique, the same destionation address&port can be used. So theoretically you could have some two hundred trillion connections to a port (32 bit addresses * 16 bit ports minus non-allowed addresses.)
In practical terms: check max file descriptor count. A few dozen to a few hundred should be ok for web server -class systems. Try and see what works.

802.1x per host authentication under one port with multi-host access by hub

Dear,
While multi-host connect to one port by hub, it seems that in multi-host mode, after one host passed the authentication, the port change state to up, and the other hosts do not need to authenticate any more. And in single host mode, only one host could access to the network under one port.
In the situation with multi-host access to one port by hub, is it possible that we could control per user access by authentication for each?
We did some test on 3550, it seems that the 3550 doesnot support what we need. And what about 4506?
Thanks!

Multiauthentication Mode
Available in Cisco IOS Release 12.2(33)SXI and later releases, multiauthentication (multiauth) mode allows one 802.1X/MAB client on the voice VLAN and multiple authenticated 802.1X/MAB/webauth clients on the data VLAN. When a hub or access point is connected to an 802.1X port (as shown in Figure 60-5), multiauth mode provides enhanced security over the multiple-hosts mode by requiring authentication of each connected client. For non-802.1X devices, MAB or web-based authentication can be used as the fallback method for individual host authentications, which allows different hosts to be authenticated through different methods on a single port.
Multiauth also supports MDA functionality on the voice VLAN by assigning authenticated devices to either a data or voice VLAN depending on the data that the VSAs received from the authentication server.
Release 12.2(33)SXJ and later releases support the assignment of a RADIUS server-supplied VLAN in multiauth mode, by using the existing commands and when these conditions occur:
•The host is the first host authorized on the port, and the RADIUS server supplies VLAN information.
•Subsequent hosts are authorized with a VLAN that matches the operational VLAN.
•A host is authorized on the port with no VLAN assignment, and subsequent hosts either have no VLAN assignment, or their VLAN information matches the operational VLAN.
•The first host authorized on the port has a group VLAN assignment, and subsequent hosts either have no VLAN assignment, or their group VLAN matches the group VLAN on the port. Subsequent hosts must use the same VLAN from the VLAN group as the first host. If a VLAN list is used, all hosts are subject to the conditions specified in the VLAN list.
•After a VLAN is assigned to a host on the port, subsequent hosts must have matching VLAN information or be denied access to the port.
•The behavior of the critical-auth VLAN is not changed for multiauth mode. When a host tries to authenticate and the server is not reachable, all authorized hosts are reinitialized in the configured VLAN.
NOTE :
•Only one voice VLAN is supported on a multiauth port.
•You cannot configure a guest VLAN or an auth-fail VLAN in multiauth mode.
for more information :
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/dot1x.html

802.1x per host authentication under one port with multi-host access by switch

In the situation with multi-host access to one port of Cisco 2960 Lan Lite by another simple L2 switch, is it possible that we could control per user access by authentication for each?
What happens if I connect to the switch (which already has some trusted devices) a untrusted device?
What happens if I connect to the switch (which already has some untrusted device) a trusted device?
If I use "authentication violation protect" traffic will be blocked only by an untrusted device or all devices connected via a simple L2 switch?
I read the manual, but it is not made detailed clarity.
Please tell me the right way.
I will be very grateful for your advice!

Hello,
In the situation with multi-host access to one port of Cisco 2960 Lan Lite by another simple L2 switch, is it possible that we could control per user access by authentication for each?
Yes, that's why multi-host mode exists
What happens if I connect to the switch (which already has some trusted devices) a untrusted device? If it's on single host the port will go into error-disabled as the violation of just one client per port has been triggered.
What happens if I connect to the switch (which already has some untrusted device) a trusted device?Same thing than before if being on single mode.
If I use "authentication violation protect" traffic will be blocked only by an untrusted device or all devices connected via a simple L2 switch?
Only for the unknown client MAC address, the trusted devices will be able to comunicate.
For more information about Core and Security Networking follow my website at http://laguiadelnetworking.
Any question contact me at [email protected]
Cheers,
Julio Carvajal Segura

802.1X Authentication issues when moving between switch ports

Hi Guys,
We are having some issues at our office where when users move from one switch to another, the 802.1X authentication does not want to take place. The PC just gets an APIPA address. Now I have read about features that MAC Move and MAC replace but they seem to be used when moving from one port a switch to another port on that same switch. Will MAC move help for issues between switches? And should I focus my attention on the switch's configuration or have a look at the NPS server that might be blocking that authentication as the user is already authenticated?
My configuration we have on the switch ports look as follows:
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
dot1x pae authenticator
Your help is greatly appreciated.
Grant

Hi Neno,
Thanks for the reply. We are using NPS on a Server 2008 R2 virtual machine. The switches are stacked 2960S-48FPS-L running 15.0(2)SE. I will quickly do the debugs and get back to you.
Here is the config:
aaa group server radius customer-nps
server name radius1
server name radius2
aaa authentication dot1x default group radius
dot1x system-auth-control
radius server radius1
address ipv4 172.28.130.52 auth-port 1645 acct-port 1646
key 7 05392415365959251C283630083D2F0B3B2E22253A
radius server radius2
address ipv4 172.28.131.52 auth-port 1645 acct-port 1646
key 7 107C2B031202052709290B092719181432190D000C
interface GigabitEthernet1/0/1
switchport access vlan 300
switchport mode access
switchport voice vlan 2
srr-queue bandwidth share 1 30 35 5
queue-set 2
priority-queue out
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication periodic
authentication timer reauthenticate 28800
authentication timer inactivity 1800
mab
no snmp trap link-status
mls qos trust cos
dot1x pae authenticator
auto qos trust cos
storm-control broadcast level 1.00
storm-control multicast level 1.00
spanning-tree portfast
spanning-tree bpdufilter enable

Access Connections Ethernet Location Switching only saves one port at a time

Like many other people, I cannot get automatic location switching between two Ethernet networks to work properly.
I have two stored network locations; one for home and one for work. Both of these are set up as Best Available Network with both Ethernet and Wireless.
Under Tools - Location Switching, both networks are listed, and "Include Ethernet connections in automatic switching and prompt me to save Ethernet ports" is checked. However, in the details column, the current location has 1 saved port(s), and the other has 0 saved ports. The saved port is always the one most recently connected.
If I go to Edit Saved Ports, only one location is listed, with the correct IP address and MAC address for the router. If I connect at the other location, only that location is listed, again with the correct IP address and MAC address.
The router IP addresses are different (work is 192.168.0.1, and home is 192.168.1.254), and obviously the MAC addresses are different, so it should be possible for Access Connections to distinguish them. Unfortunately the only "editing" that is possible is to delete the saved port. I would be happy to add a saved port manually, but that is not an option. In addtion, despite the "...prompt me to save Ethernet ports" being checked, I have never received a prompt. Even if I delete the saved port, it resaves automatically next time without any prompt.
I have also tried setting up both locations as Ethernet only, but have exactly the same problem.
My T520 was supplied with Access Connections 5.85 preinstalled. I tried upgrading to 5.97 in the hope that it had been fixed in the meantime. Unfortunately it has not.
Access Connections is still marginally useful to me for automatic switching between Wireless and Ethernet, and for a simple manual switch of settings such as default printer, home page, and file sharing. However, it would be very useful for the home and work locations to be autodetected and switched.
From the number of unresolved questions on this board on the same topic, it appears that this is a long standing deficiency with Access Connections. Is there any chance of this being fixed?

I found from another bulletin board that ethernet location switching seemed to work OK with Access Connections 3.82, but stopped working with releases after that, and from my experience still does not work with 5.97
http://www.thinkpads.com/forum/viewtopic.php?f=18&t=38514
Two questions:
1. Does anyone know if Access Connections 3.82 works with Windows 7?
2. If so, where could I get a copy? The oldest version on the Lenovo website appears to be 5.50
I will refrain from commenting on the necessity of going back to such an old version to recover basic functionality for this utility......

Use only one port to answer web service

I make web services to many companies.
In a company they have a firewall and said me they need use only one port to put a web service.
The web service is instanced in a one port, but the answer is made in different port (negociation between client and web server), when they use in a test server (with out firewall) the web service functioin OK, but when it is updated in Production (with firewall and the 7779 port open) don't function.
I use OAS 10.2.
Somebody know wath can I do.
Thanks a lot.
MIGUEL ANGEL CARO
[email protected]

Hi,
Are you sure the proxy is configured (using IE) for the user running the host instance? (Especially on non development machines) this is not by default the same user as the currently logged in user.
HTH,
Randal van Splunteren 2 x MVP BizTalk Server, MCTS BizTalk Server
my blog
Check out the PowerShell provider for BizTalk
Please mark as answered if this answers your question.

Is it Ok to put many classes in one file ?

Hi all,
This is another beginner question. I was wondering, is it good practice to put many classes in one single file? Sometimes I notice there are many classes inside one big file and sometimes each class is in its own separate file. Is there an advantage in separating each class in each different file? For e.g. one big file, called A.java:
class A {
    public static void main(String[] args) { }
class B {}
class C {}
class D {}Is it better to have class B in a B.java file, and class C in C.java, etc? In the real-world workplace, what is the usual practice?
Thank you for your replies.
P/S : I love Java, it's so cool. :-)

I have also seen situations, in large software systems, where a compile that fails partway through will leave the top level classes that do not match the file name unbuilt, and some compilers will then not be able to build, because they cannot map the class name to the source file.
? {?

How many ipods on one computer?

Clearly new to this music download stuff! My dgtr just got a shuffle, I have an MP3 sansa can we both use itunes to get music? The reason I ask is we heard we can not charge our ipod at my sisters when out of town only one ipod per computer???? This makes no sense clearly people have more then one ipod in some homes so what do we do? Can I plug the ipod shuffle into my sister's computer to charge or download from?
Also well I am here can I use itunes with the sansa MP3 as that would be awesome, although I need clear directions on how to do that.
Thanks so much for your help old mom with new technology is frustrated!!!
have a great night
M

You can use as many ipods with one PC as you want, but only have one plugged in at a time.
Here is an article on that. I prefer method 2.
http://support.apple.com/kb/HT1495
The Sansa player, you can't load anything onto it from itunes.
Just use Windows Explorer to drop MP3 files onto it. Also, iTunes Store purchases are in AAC format and I don't think will play on a Sansa. So buy mp3s from Amazon for the Sansa.

Can I use iCloud to since many users to one account for my business and have me as a administrator to oversee and change peoples calendars?

Can I use iCloud to since many users to one account for my business and have me as a administrator to oversee and change my employees calendars and contacts??

Go to System Preferences and click Sign Out, select Delete at all the prompts, then sign back in with the changed ID? (Your iCloud data will disappear from your Mac when you sign out and choose Delete, but will still be in iCloud. Provided you are signing back into the same account your data will reappear on your Mac when you sign back in.)

How to update many documents in one go using portal permissions

Hello,
I have two users in the portal with different permissions on a folder:
rct2774: Total control
rct3343: Read
So, connected to the portal, rct3343 can´t upload (or erase) any document.
Now, I´ve followed these instructions to update many documents in one go (found in "how to upload a folder containg HTML files in a KM folder" topic 22 - jun - 2006)
"You can use the WebDaV.
1. Get the WebDav path of your KM folder by going to details->properties->Access Links
2. Copy the url for the WebDav
3. Go to your desktop. Right Click on My Network Places.
click on open.
4. Click on add a network place.
5. Click on "Choose another network location"
6. Paste your copied url and click on next.
7. Enter your portal userid and password. Now drag and drop your files from desktop. "
But, updating this way both users (rct2774 and rct3343) can update, download and erase any document that belongs to that location.
Do you know a way to update many documents in one go respecting or keeping the portal permissions?
Thanks in advance.
Best Regards,
Esteban

Hi Marc,
First of all, thaks for your prompt reply. I´m new in these themes and any help is wellcome.
We are doing many tests now, so we´re using the server portal as repository in itself. It´s quite strange because the permissions work at the portal correctly but not by the other way.
Should I download the portal drive to the client PC for mantain the portal permissions?
Thank you!

Is it possible to have too many keyframes in one project in Premiere?

Hi all,
I'm using Premiere 6 on a Windows 7 ULT machine.
Is it possible to have too many keyframes in one project in Premiere?
I'm getting app crashes when I try to re-open a certain project in Premiere 6 and it seems that if that file has over 93 keyframes, then it will not re-open. But I can re-open that exact same project file with 93 keyframes in it, no problem.
But if I go any further and create any more keyframes than 93 in a new re-saved version of the exact same file, then that file will not re-open and I get an app crash... you can see screenshots of the two Windows app crash info panels below that I'm getting from three different bad Premiere project files that I've created so far.
I've tested and tested what is going on here and this seems to be what is causing the bad files. I've re-created the scenario and re-created files with over 93 keyframes from the same base project file that will still open... as soon as I get more than 93 keyframes in this file, then that newly saved file will not re-open after I close and try to re-open it.
This is 75 keyframes in one still image clip, 14 keyframes in another still image clip and 2 keyframes each in two other still image clips in a single project file... that is the limit... if I create any more keyframes in the clip that has 75 keyframes, the new file will save and render, but it won't re-open once it has been closed.
The two slightly different app crash info panels show, in the first one below,
"Fault Module Name: StackHash_e98d"
... and the second one shows,
"Fault Module Name: PREMINFO.dll"
... both messages with a little more different info in each one. I get either of the two error info panels when trying to re-open all three bad files that I've created with over 93 keyframes in them. That is, two of the files alternate between giveing "StackHash_e98d" and "PREMINFO.dll" when trying to open them and one of them always shows the "Fault Module Name: PREMINFO.dll" error.
So even the error messages are inconsistent with two of the bad files.
I've searched the internet for this error in association with Premiere and I've also searched on this forum and found nothing. Can anyone shed any light on this?
Thanks,
digi

Bill,
Even though I figured out a work around, I was still interested to know if these file opening crashes are related to Virtual Memory.
So on the topic of Virtual Memory... a few months ago I was troubleshooting a different problem in Premeire and I found this information...
"To improve performance in Premiere Pro, adjust the size of the paging file to a maximum of twice the amount of installed RAM."
Previous to that time three months ago or so, I had my Virtual Memory settings at the default automatic setting, but I tried setting my VM to twice the amount of installed RAM, and I've had it set that way ever since, just to make sure I'm optimizing the VM performance for Premiere and other apps.
But that isn't making any difference in this case. Today I also found information in a search that says to troubleshoot StackHash crashes, one should turn off "DEP" in the system settings for the application with the crash problem... according to the paragraph below, from the second post down by Chris on this tdistler.com page... http://tdistler.com/2009/04/10/stackhash-and-application-crashes-on-windows
Even though this was written in 2009 with Windows Vista in mind, many things for Vista work in Windows 7... it says,
"Here’s how 99 percent of Vista users can fix a StackHash failure. I’ll walk you through it step by step:
Method A:
1. Open your Start menu and click Control Panel
2. Browse to “System Maintenance” then “System”
3. In the left panel, select “Advanced System Settings” from the available links
4. You should now see the System Properties Window, which will have three sections. The top section is labeled “Performance” and has a “Settings” button. Click this button.
5. Select the “Data Execution Prevention” tab.
6. Select the option which reads “Turn on DEP for all programs and services except those I select”
7. Use the “Browse” button to locate the executable file for the application you were trying to start when you received the StackHash error, and click Open to add it to your exceptions list.
8. Click Apply or OK to commit your changes."
But I tried this and none of the three problem files that I encountered would open... I still got the StackHash_e98d or PREMINFO.dll crash errors.
So anyway, I'm a ways past that in my project now, just continuing with more keyframes over the number of 78 in separate but identical still image clips... that allows me to successfully work with this project with as many keyframes as I need.
Thanks again,
digi

When ordering enlarged photos from iPhoto, must I purchase them one at a time and pay a shipping fee for each and very one of them. Sort of a ripoff but I can't figure how to purchase many and pay one shipping fee.

When ordering enlarged photos from iPhoto, must I purchase them one at a time and pay a shipping fee for each and very one of them. Sort of a ripoff but I can't figure how to purchase many and pay one shipping fee.

You may have better luck posting in the iPhoto forum if no one on this forum is able to assist. I'm sure you are doing something wrong though.

HT204411 i am trying to purchase many songs at one time. i have added all songs to wish list , now to purchase it will only let me do one at a time please advise how i can purchase more than one at a time

i am trying to purchase many songs at one time. i have added all songs to wish list , now to purchase it will only let me do one at a time please advise how i can purchase more than one at a time

There used to be a 'buy all' button on the wish list screen but for some reason that has been removed from the current version of iTunes so you will need to buy each item individually. You can try leaving feedback for Apple and maybe it'll be added back in a future update : http://www.apple.com/feedback/itunesapp.html

802.1x Blocking port (many deviсes to one port)

Similar Messages

Maybe you are looking for