Which interface-level command is needed to turn on 802 1X authentication?

The dot1x pae authenticator command is the specific interface-level command required to enable IEEE 802.1X authentication on a switch port. This command configures the port to act as a Port Access Entity (PAE) authenticator, which is the entity that facilitates the authentication process between the supplicant (endpoint device) and the authentication server (e.g., RADIUS). Without this command on the interface, the port will not initiate or enforce 802.1X authentication, even if 802.1X is enabled globally on the switch.

B. dot1x system-auth-control This is a global configuration command, not an interface-level command. It is required to enable 802.1X functionality on the switch as a whole.
C. authentication host-mode single-host This interface-level command defines the session control mode (e.g., how many hosts can be authenticated), but it does not enable the 802.1X authentication process itself.
D. aaa server radius dynamic-author This is a global command used to configure the switch to accept Change of Authorization (CoA) requests from a RADIUS server; it does not enable 802.1X on an interface. ---

1. Cisco Systems

"Configuration Guide

Cisco IOS XE Bengaluru 17.6.x (Catalyst 9300 Switches) - Configuring IEEE 802.1X Port-Based Authentication".

Section: "Enabling 802.1X Authentication on an Interface"

Content: This document explicitly lists the dot1x pae authenticator command as the step to "Enable 802.1X authentication on the interface." It also clarifies that dot1x system-auth-control is a prerequisite global command.

2. Cisco Systems

"Catalyst 3750-X and 3560-X Switch Software Configuration Guide

Release 12.2(55)SE - Configuring IEEE 802.1X Port-Based Authentication".

Section: "Enabling 802.1X on an Interface"

Content: The guide states

"To enable 802.1X on an interface

you must enable authentication on the port and specify the port control method. The dot1x pae authenticator interface configuration command enables 802.1X on the port and specifies that the switch acts as the authenticator."

3. Cisco Systems

"Cisco Identity-Based Networking Services Configuration Guide

Cisco IOS Release 15.2(6)E".

Section: "Configuring IEEE 802.1X Port-Based Authentication"

Content: This guide details the configuration steps

showing that dot1x pae authenticator is the command used in interface configuration mode to set the Port Access Entity (PAE) type to authenticator

thereby enabling the feature on that specific port.