44-8
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 44 Configuring Network Admission Control
Configuring Network Admission Control with LAN Port IP
Configuring LAN Port IP
This section describes how to configure LAN port IP.
Note To display LAN port IP configuration information and to clear LAN port IP configuration elements, see
the “LAN Port IP CLI Command Examples” section on page 44-9. To configure policy-based ACLs
(PBACLs), see the “Configuring Policy-Based ACLs” section on page 44-21.
Note For assistance in following these configuration steps, see the “LAN Port IP Configuration Example”
section on page 44-30.
To configure LAN port IP, perform these steps:
Step 1 Enable LAN port IP globally on the switch by entering the set eou {enable | disable} command (the
default is disabled).
Console> (enable) set eou enable
EoU globally enabled.
Console> (enable)
Step 2 Enable LAN port IP on a per-port basis by entering the set port eou mod/port {bypass | auto | disable
| initialize | revalidate} command.
Console> (enable) set port eou 7/1 auto
EoU enabled on 7/1
Console> (enable)
Step 3 Define the RADIUS server and RADIUS key by entering the following commands:
set radius server ip_addr [auth-port port] [acct-port port] [primary]
set radius key key
This example shows how to define the RADIUS server:
Console> (enable) set radius server 10.76.39.93 auth-port 1812 primary
10.76.39.93 with auth-port 1812 acct-port 1813 added to radius server table as primary
server.
Console> (enable)
This example shows how to define the RADIUS key:
Console> (enable) set radius key cisco
Radius key set to cisco
Console> (enable)
Step 4 Define a policy-based ACL (PBACL) and map it to a VLAN as follows:
a. Enable DHCP snooping and/or ARP inspection:
set security acl ip acl-name permit dhcp-snooping
set security acl ip acl-name permit arp-inspection
b. Enable EAPoUDP redirection:
set security acl ip acl-name permit eapoudp
To Next Page
Loading...
Need help?
General