# Cisco SG350

## Preliminary assumptions


## **Configuration of connection with RADIUS server**

```bash
configure
aaa authentication dot1x default radius
radius-server key RADIUS_KEY
S1(config)#radius-server host NACVIEW_SERV
S1(config)#radius server enable
S1(config)#aaa accounting dot1x start-stop group radius
S1(config)#dot1x system-auth-control
S1(config)#dot1x traps authentication failure
S1(config)#dot1x traps authentication success
S1(config)#dot1x supplicant traps authentication failure
S1(config)#dot1x supplicant traps authentication success
```

## Configuration of authorization

### 802.1x protocol (per interface)

```bash
S1#configure terminal
S1(config)#interface ge1
S1(config-if)#dot1x host-mode multi-session
S1(config-if)#dot1x reauthentication
S1(config-if)#dot1x authentication 802.1x
S1(config-if)#dot1x radius-attributes vlan static
S1(config-if)#dot1x port-control auto
```

###  MAC address authorization (per interface)

```bash
S1#configure terminal
S1(config-if)#interface ge 2
S1(config-if)#dot1x authentication mac
S1(config-if)#dot1x reauthentication
S1(config-if)#dot1x radius-attributes vlan static
S1(config-if)#dot1x port-control auto
```

### 802.1x protocol  + fall-back  for MAC address authorization (per interface)

```bash
S1#configure terminal
S1(config)#interface ge 3
S1(config-if)dot1x host-mode multi-session
S1(config-if)dot1x reauthentication
S1(config-if)dot1x authentication 802.1x mac
S1(config-if)dot1x radius-attributes vlan static
S1(config-if)dot1x port-control auto
```

### MAC address authorization + fall-back for 802.1x (per interface)

```bash
S1#configure terminal
S1(config)interface ge 4
S1(config-if)#dot1x host-mode multi-session
S1(config-if)#dot1x reauthentication
S1(config-if)#dot1x authentication mac 802.1x
S1(config-if)#dot1x radius-attributes vlan static
S1(config-if)#dot1x port-control auto
```

## SNMP

### SNMP v3 (recommended version)

```bash
S1#configure
S1(config)#snmp-server engineID local e3e3e3e3
S1(config)#snmp-server enable traps
S1(config)#snmp-server group SNMP_GROUP v3 priv write Default notify Default
S1(config)#snmp-server user SNMP_USER SNMP_GROUP v3 auth sha SNMP_AUTH priv SNMP_PRIV
S1(config)#snmp-server host NACVIEW_SERV version 3 priv SNMP_USER
S1(config)#snmp-server host NACVIEW_SERV traps version 3 SNMP_USER
S1(config)#snmp-server host NACVIEW_SERV informs version 3 SNMP_USER
```

### SNMP v2c (version not recommended - ensuring the minimal safety level)

```bash
S1#configure
S1(config)#snmp-server community SNMP_SECRET rw view Default
S1(config)#snmp-server enable traps
S1(config)#snmp-server host NACVIEW_SERV traps version 2c SNMP_SECRET
S1(config)#snmp-server host NACVIEW_SERV informs version 2c SNMP_SECRET
S1(config)#dot1x traps authentication failure
S1(config)#dot1x traps authentication success
S1(config)#dot1x supplicant traps authentication failure
S1(config)#dot1x supplicant traps authentication success
```

### System logs redirection to NACVIEW server

```bash
S1#configure terminal
S1(config)#logging host NACVIEW_SERV
```

## **Auxiliary recommendations**

Pagination exclusion (off): `S1#terminal datadump`

Current device configuration: `S1#show running-config`

802.1x Configuration: `S1#show dot1x`

Interface x configuration 802.1x: `S1#show dot1x interface ge x`

Information about 802.1x authenticated users: `S1#show dot1x users`

RADIUS server configuration: `S1#show radius server configuration`

Interface x 802.1x statistics: `S1#show dot1x statistics interface ge x`

Current configuration copying on NACVIEW server: ` S1#copy running-config tftp://NACVIEW_SERV/CONFIG-NAME.txt`

Saved configuration copying on NACVIEW server: `S1#copy startup-config tftp://NACVIEW_SERV/CONFIG-NAME.txt`

Configuration copying from NACVIEW server to current configuration: `S1#copy tftp://NACVIEW_SERV/CONFIG_NAME.txt running-config`

Configuration copying from NACVIEW server to saved configuration: `S1#copy tftp://NACVIEW_SERV/CONFIG_NAME.txt startup-config`
