10-20
Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-08
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
For a single session, when the switch port has no ACL configured, after the host authenticates and has
authorization policies, the Auth-Default-ACL is created and the policies are enforced.
If multiple sessions authenticate on a port, the policies for the first host are applied without IP address
i
nsertion. When subsequent hosts authenticate on the port, the policies applied on the first host are
refreshed with IP address insertion, and applied with IP address insertion to all subsequent hosts.
Note When you configure the open directive, policies are always applied with IP address insertion.
If a host falls back to web authentication on a port without an ACL configured, the Auth-Default-ACL
is
created and the access control entries in the fallback ACL are converted to per-user entries and
installed with IP address insertion. If the Auth-Default-ACL is already present on the port when a host
falls back to web authentication, the entries in the fallback ACL are converted to per-user entries with
IP address insertion for the web authenticated host. The Auth-Default-ACL is reapplied with IP address
insertion to hosts that were previously authenticated on the port.
Cisco Secure ACS and Attribute-Value Pairs for the Redirect URL
The switch uses these cisco-av-pair VSAs:
• url-redirect is the HTTP to HTTPS URL.
• url-redirect-acl is the switch ACL name or number.
The switch uses the CiscoSecure-Defined-ACL A
V pair to intercept an HTTP or HTTPS request from
the endpoint device. The switch then forwards the client web browser to the specified redirect address.
The url-redirect AV pair on the Cisco Secure ACS contains the URL to which the web browser is
redirected. The url-redirect-acl AV pair contains the name or number of an ACL that specifies the HTTP
or HTTPS traffic to redirect. Traffic that matches a permit ACE in the ACL is redirected.
Note Define the URL redirect ACL and the default port ACL on the switch.
If a redirect URL configured for a client on the authentication server, a default port ACL on the
co
nnected client switch port must also be configured
Cisco Secure ACS and Attribute-Value Pairs for Downloadable ACLs
You can set the CiscoSecure-Defined-ACL Attribute-Value (AV) pair on the Cisco Secure ACS with the
RADIUS cisco-av-pair vendor-specific attributes (VSAs). This pair specifies the names of the
downloadable ACLs on the Cisco Secure ACS with the #ACL#-IP-name-number attribute.
• The name is the ACL name.
• The number is the version number (for example, 3f783768).
If a downloadable ACL is configured for a client on the authentication server, a default port ACL on the
co
nnected client switch port must also be configured.
If the default ACL is configured on the switch and the Cisco Secure ACS sends a host-access-policy to
th
e switch, it applies the policy to traffic from the host connected to a switch port. If the policy does not
apply, the switch applies the default ACL. If the Cisco Secure ACS sends the switch a downloadable
ACL, this ACL takes precedence over the default ACL that is configured on the switch port. However,
if the switch receives an host access policy from the Cisco Secure ACS but the default ACL is not
configured, the authorization failure is declared.
To Next Page
Loading...
Need help?
General
