MultiAuth Authentication

Authentication mode support provides for the global setting of a single authentication mode 802.1X (strict-mode) or multiple modes (MultiAuth) per user or port when authenticating.

Strict mode is the appropriate mode when authenticating a single 802.1X user. All traffic on the port receives the same policy in strict mode. When authenticating PWA, CEP, or MAC, you must use MultiAuth authentication, whether authenticating a single or multiple supplicants.

MultiAuth authentication supports the simultaneous configuration of up to seven authentication methods per user on the same port, but only one method per user is actually applied. When MultiAuth authentication ports have a combination of authentication methods enabled, and a user is successfully authenticated for more than one method at the same time, the configured authentication method precedence will determine:

• Which RADIUS-returned filter ID will be processed and result in an applied traffic policy profile, in the case of 802.1X, MAC, PWA, and CEP. See Setting MultiAuth Authentication Precedence for authentication method precedence details.
• Whether a quarantine policy is applied, in the case of the quarantine agent
• Whether an auto-tracking session is created and an admin-policy (if it exists) is applied

The number of users or devices MultiAuth authentication supports depends upon the type of device, whether the ports are fixed access or uplink, and whether increased port capacity or extra chassis user capacity MUA licenses have been applied. See the firmware customer release note that comes with your device for details on the number of users or devices supported per port.

In Authenticating Multiple Users With Different Methods on a Single Port, multiple users are authenticated on a single port each with a different authentication method (in this example only 802.1X, PWA, MAC, and CEP are enabled on the device). In this case, each user on a single port successfully authenticates with a different authentication type. The authentication method is included in the authentication credentials sent to the RADIUS server. RADIUS looks up the user account for that user based upon the SMAC. The filter ID for that user is returned to the switch in the authentication response, and the authentication is validated for that user.