Cisco Catalyst 4500 Series - Page 1017

44-49
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
OL-25340-01
Chapter 44 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
The following command shows that the Policy Enforced Module (EPM) session contains the Filter-Id
155 from ACS:
Note The 156 IP extended ACL is to be preconfigured on the switch, so that the policy enforcement can
happen.
Switch# show ip access-list 156
Extended IP access list 156
10 deny ip any host 155.155.155.156
20 deny ip any 156.100.60.0 0.0.0.255
30 deny tcp any host 156.100.10.116 eq www
Switch# show epm session ip 50.0.0.12
Admission feature : DOT1X
AAA Policies :
Filter-Id : 155
The following command displays the contents of the Filter-Id applied on the interface:
Switch# show ip access-list int <gi6/3>
Switch# show ip access-list interface gi6/3
deny ip host 20.20.0.2 host 155.155.155.156
deny ip host 20.20.0.2 156.100.60.0 0.0.0.255
deny tcp host 20.20.0.2 host 156.100.10.116 eq www
Guidelines for Per-User ACL and Filter-ID ACL
For per user ACL and Filter-ID ACL, the ACL source must be ANY
(permit TCP ANY host 1.1.1.1 eq 80 or permit TCP ANY host 1.1.1.1 eq 443).