46-52
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 46 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
Oper control dir: both
Session timeout: N/A
Common Session ID: 0D0202010000003D04147B45
Acct Session ID: 0x0000004A
Handle: 0x7900002A
Current Policy: POLICY_Gi2/9
Local Policies:
arp-probe-timeout: yes
Server Policies:
Per-User ACL: GigabitEthernet1/0/23#v4#7C1C4AC
: permit ip any host 1.1.1.20
Method status list:
Method State
mab Authc Success
The following command displays the contents of the per-user-acl (note that per-user-acl are shown above
as the default port ACL configured on the interface, 151 is the default port ACL in the preceding example
below):
Switch# show access-list
151
deny ip host 20.20.0.3 host 20.20.10.10
10 permit ip any any (57 estimate matches)
..
..
..(check for the mac access-list created)..
..
Extended MAC access list PerUser_MAC_ACL-589079192 (per-user)
deny any host 0000.aaaa.aaaa
..
The following command shows that the Policy Enforced Module (EPM) session contains the Filter-Id
155 from ACS:
Note The 156 IP extended ACL is to be preconfigured on the switch, so that the policy enforcement can
happen.
Switch# show ip access-list 156
Extended IP access list 156
10 deny ip any host 155.155.155.156
20 deny ip any 156.100.60.0 0.0.0.255
30 deny tcp any host 156.100.10.116 eq www
The following command shows authentication sessions that contains the Filter-Id TEST-ACL.
TEST-ACL has been defined locally:
Switch-2033# show authentication sessions interface Gi2/9 details
Interface: GigabitEthernet2/9
MAC Address: 2c54.2d6a.0344
IPv6 Address: Unknown
IPv4 Address: 7.7.7.19
User-Name: 2C-54-2D-6A-03-44
Status: Authorized
Domain: DATA
Oper host mode: multi-auth
To Next Page
Loading...
Need help?
General
