10-18
Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-08
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
–
[65] Tunnel-Medium-Type = 802
–
[81] Tunnel-Private-Group-ID = VLAN name or VLAN ID
Attribute [64] must contain the value VL
AN (type 13). Attribute [65] must contain the value 802
(type 6). Attribute [81] specifies the VLAN name or VLAN ID assigned to the
IEEE 802.1x-authenticated user.
For examples of tunnel attributes, see the “Co
nfiguring the Switch to Use Vendor-Specific RADIUS
Attributes” section on page 9-35.
802.1x Authentication with Per-User ACLs
You can enable per-user access control lists (ACLs) to provide different levels of network access and
service to an 802.1x-authenticated user. When the RADIUS server authenticates a user connected to an
802.1x port, it retrieves the ACL attributes based on the user identity and sends them to the switch. The
switch applies the attributes to the 802.1x port for the duration of the user session. The switch removes
the per-user ACL configuration when the session is over, if authentication fails, or if a link-down
condition occurs. The switch does not save RADIUS-specified ACLs in the running configuration. When
the port is unauthorized, the switch removes the ACL from the port.
You can configure router ACLs and input port ACLs on the same switch. However, a port ACL takes
pr
ecedence over a router ACL. If you apply input port ACL to an interface that belongs to a VLAN, the
port ACL takes precedence over an input router ACL applied to the VLAN interface. Incoming packets
received on the port to which a port ACL is applied are filtered by the port ACL. Incoming routed packets
received on other ports are filtered by the router ACL. Outgoing routed packets are filtered by the router
ACL. To avoid configuration conflicts, you should carefully plan the user profiles stored on the RADIUS
server.
RADIUS supports per-user attributes, including vendor-specific attributes. These vendor-specific
a
ttributes (VSAs) are in octet-string format and are passed to the switch during the authentication
process. The VSAs used for per-user ACLs are
inacl#<
n
> for the ingress direction and outacl#<
n
> for
the egress direction. MAC ACLs are supported only in the ingress direction. The switch supports VSAs
only in the ingress direction. It does not support port ACLs in the egress direction on Layer 2 ports. For
more information, see Chapter 35, “Configuring Network Security with ACLs.”
Use only the extended ACL syntax style to define the per-user configuration stored on the RADIUS
s
erver. When the definitions are passed from the RADIUS server, they are created by using the extended
naming convention. However, if you use the Filter-Id attribute, it can point to a standard ACL.
You can use the Filter-Id attribute to specify an inbound or outbound ACL that is already configured on
th
e switch. The attribute contains the ACL number followed by .in for ingress filtering or .out for egress
filtering. If the RADIUS server does not allow the .in or .out syntax, the access list is applied to the
outbound ACL by default. Because of limited support of Cisco IOS access lists on the switch, the
Filter-Id attribute is supported only for IP ACLs numbered 1 to 199 and 1300 to 2699 (IP standard and
IP extended ACLs).
Only one 802.1x-authenticated user is supported on a port. If the multiple-hosts mode is enabled on the
p
ort, the per-user ACL attribute is disabled for the associated port.
The maximum size of the per-user ACL is 4000 ASCII characters but is limited by the maximum size of
R
ADIUS-server per-user ACLs.
For examples of vendor-specific attributes, see the “
Configuring the Switch to Use Vendor-Specific
RADIUS Attributes” section on page 9-35. For more information about configuring ACLs, see
Chapter 35, “Configuring Network Security with ACLs.”
To Next Page
Loading...
Need help?
General
