Content

| 9.8 |  | 802.1X Port-based Authentication |
| 9.8.5 |  | 802.1X configuration guidelines |

These are the 802.1X authentication configuration guidelines:

When the 802.1X protocol is enabled, ports are authenticated before any other Layer 2 feature is enabled.

The 802.1X protocol is supported on Layer 2 static-access ports, but it is not supported on the following port types:

- Attempting to enable 802.1X on a trunk port will generate an error message, and 802.1X will not be enabled. The port mode will not change if the mode of an 802.1X enabled port is changed to trunk.
- A port in dynamic mode can negotiate with its neighbor to become a trunk port. Attempting to enable 802.1X on a dynamic port will result in an error message, and 802.1X will not be enabled. The port mode will not change if the mode of an 802.1X-enabled port is changed to dynamic.
- Attempting to enable 802.1X on a dynamic-access (VLAN Query Protocol [VQP]) port will generate an error message, and 802.1X will not be enabled. Attempting to change an 802.1X-enabled port to dynamic VLAN assignment will generate an error message, and the VLAN configuration will not be changed.
- Before enabling 802.1X on the port, first remove the port from the EtherChannel before enabling 802.1X on it. Attempting to enable 802.1X on an EtherChannel or on an active port in an EtherChannel will generate an error message, and 802.1X will not be enabled. A port will not join the EtherChannel if 802.1X is enabled on a not-yet active port of an EtherChannel,
- A secure port cannot be configured as an 802.1X port. Attempting to enable 802.1X on a secure port will generate an error message, and 802.1X will not be enabled. Port security settings will not change if an 802.1X-enabled port is changed to a secure port, and an error message will be generated.
- 802.1X can be enabled on a port that is a SPAN destination port. However, 802.1X is disabled until the port is removed as a SPAN destination. 802.1X can be enabled on a SPAN source port.