Cisco 7604 User Manual

45-19
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
OL-4266-08
Chapter 45 Configuring Network Admission Control
Configuring NAC
Step 3
Router(config)# access-list
access-list-number {deny | permit}
source [ source-wildcard ] [log]
Defines the default port ACL by using a source address and wildcard.
The access-list-number is a decimal number from 1 to 99 or 1300 to 1999.
Enter deny or permit to specify whether to deny or permit access if
conditions are matched.
The source is the source address of the network or host from which the
packet is being sent specified as follows:
• The 32-bit quantity in dotted-decimal format.
• The keyword any as an abbreviation for source and source-wildcard
value of 0.0.0.0 255.255.255.255. You do not need to enter a
source-wildcard value.
• The keyword host as an abbreviation for source and source-wildcard
of source 0.0.0.0.
(Optional) Applies the source-wildcard wildcard bits to the source.
(Optional) Enters log to cause an informational logging message about the
packet that matches the entry to be sent to the console.
Step 4
Router(config-if)# interface
interface-id
Enters interface configuration mode.
Step 5
Router(config-if)# ip access-group
{
access-list-number | name } in
Controls access to the specified interface.
Step 6
Router(config-if)# ip admission
name
rule-name
Applies the specified IP NAC rule to the interface.
To remove the IP NAC rule that was applied to a specific interface, use the
no ip admission rule-name interface configuration command.
Step 7
Router(config)# exit
Returns to global configuration mode.
Step 8
Router(config)# aaa new-model
Enables AAA.
Step 9
Router(config)# aaa authentication
eou default group radius
Sets authentication methods for EAPoUDP.
To remove the EAPoUDP authentication methods, use the no aaa
authentication eou default global configuration command.
Step 10
Router(config)# aaa authorization
network default local
Sets the authorization method to local. To remove the authorization method,
use no aaa authorization network default local command.
Step 11
Router(config)# ip device tracking
Enables the IP device tracking table.
To disable the IP device tracking table, use the no ip device tracking
global configuration commands.
Step 12
Router(config)# ip device tracking
[probe {count
count | interval
interval }]
(Optional) Configures these parameters for the IP device tracking table:
• count count—Sets the number of times that the switch sends the ARP
probe. The range is from 1 to 5. The default is 3.
• interval interval—Sets the number of seconds that the switch waits
for a response before resending the ARP probe. The range is from 30
to 300 seconds. The default is 30 seconds.
Command Purpose

Cisco 7604 Specifications

General

Brand	Cisco
Model	7604
Category	Network Router
Language	English