Cisco Catalyst 4500 Series Administration Guide

48-5
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL-27597-01
Chapter 48 Configuring Web-Based Authentication
About Web-Based Authentication
LAN Port IP
You can configure LAN port IP (LPIP) and Layer 2 web-based authentication on the same port. The host
is authenticated using web-based authentication first, followed by LPIP posture validation. The LPIP
host policy overrides the web-based authentication host policy.
If the web-based authentication idle timer expires, the NAC policy is removed. The host is authenticated
and posture is validated again.
Gateway IP
You cannot configure Gateway IP on a Layer 3 VLAN interface if web-based authentication is
configured on any of the switch ports in the VLAN.
You can configure web-based authentication on the same Layer 3 interface as Gateway IP. The host
policies for both features are applied in software. The GWIP policy overrides the web-based
authentication host policy.
ACLs
If you configure a VLAN ACL or Cisco IOS ACL on an interface, the ACL is applied to the host traffic
only after the web-based authentication host policy is applied.
For Layer 2 web-based authentication, you must configure a port ACL (PACL) as the default access
policy for ingress traffic from hosts connected to the port. After authentication, the web-based
authentication host policy overrides the PACL.
You cannot configure a MAC ACL and web-based authentication on the same interface.
You cannot configure web-based authentication on a port whose access VLAN is configured for VACL
capture.
Context-Based Access Control
Web-based authentication cannot be configured on a Layer 2 port if context-based access control
(CBAC) is configured on the Layer 3 VLAN interface of the port’s VLAN.
802.1X Authentication
You cannot configure web-based authentication on the same port as 802.1X authentication except as a
fallback authentication method.
EtherChannel
You can configure web-based authentication on a Layer 2 EtherChannel interface. The web-based
authentication configuration applies to all member channels.
Switchover
On Catalyst 4500 series switches with redundant supervisor engines in RPR mode, information about
currently authenticated hosts is maintained during a switchover. You do not need to reauthenticate.

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E