Cisco Catalyst 4500 Series Configuration Guide

44-38
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
OL-25340-01
Chapter 44 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
Switch(config-if)# authentication port-control auto
Switch(config-if)# authentication host-mode multi-auth
Switch(config-if)# map eap
Switch(config-if)# no shut
Switch(config-if)# end
Configuring 802.1X Authentication with ACL Assignments and Redirect URLs
This section includes these topics:
• Downloadable ACL, page 44-38
• URL-Redirect, page 44-40
• Configuring a Downloadable Policy, page 44-43
Downloadable ACL
The downloadable ACL (DACL) feature allows you to download device specific authorization policies
from the authentication server. These policies activate after authentication succeeds for the respective
client and the client’s IP address was populated in the IP device tracking table. (Downloadable ACL is
applied on the port, once the port is authenticated and the IP device tracking table has the host IP address
entry).
The following sections describe the configuration that is necessary to complement the related
authentication (802.1X or MAB) configuration. (No unique configuration is required on the switch. All
of the configuration is on the ACS.) After authentication succeeds, enter the show ip access-list
command to display the downloadable ACLs.
Configuring the Switch for Downloadable ACL
To configure the switch for downloadable ACL, follow these steps:
Step 1 Configure the IP device tracking table.
Switch(config)# ip device tracking
Step 2 Configure RADIUS VSA to forward authentication.
Switch(config)# radius-server vsa send authentication
Step 3 Configure static ACL for the interface.
Switch(config)# int g2/9
Switch(config-if)# ip access-group pacl-4 in
Interface Configuration Example
Switch# show running-configuration interface g2/9
Building configuration...
Current configuration : 617 bytes
!
interface GigabitEthernet2/9
switchport
switchport access vlan 29
switchport mode access

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E