Configuring RADIUS Server Support for Switch Services
Configuring and Using RADIUS-Assigned Access Control Lists
5. Test client access on the network to ensure that your RADIUS-based ACL
application is properly enforcing your policies.
For further information common to all ACL applications, refer to the following
sections in chapter 9, “Access Control Lists (ACLs)”:
■ “Features Common to All ACLs” on page 9-10
■ “General Steps for Planning and Configuring ACLs” on page 9-11
■ “Planning an ACL Application” on page 9-16
The Packet-filtering Process
Packet-Filtering in an applied ACL is sequential, from the first ACE in the ACL
to the implicit “deny any” following the last explicit ACE. This operation is the
same regardless of whether the ACL is applied dynamically from a RADIUS
server or statically in the switch configuration. For details of this process,
refer to “ACL Operation” in chapter 9, “Access Control Lists (ACLs)”.
Note If a dynamic port ACL permits an authenticated client’s inbound IP packet,
but the client port is also configured with a static port ACL, then the packet
will also be filtered by these other ACLs. If there is a match with a deny ACE
in any of these ACLs, the switch drops the packet.
Caution ACLs can enhance network security by blocking selected IP traffic, and can
serve as one aspect of maintaining network security. However, because ACLs
do not provide user or device authentication, or protection from malicious
manipulation of data carried in IP packet transmissions, they should not
be relied upon for a complete security solution.
Operating Rules for Dynamic Port ACLs
■ Relating a Client to a Dynamic Port ACL: A dynamic port ACL
for a particular client must be configured in the RADIUS server under
the authentication credentials the server should expect for that client.
(If the client must authenticate using 802.1X and/or Web Authentica-
tion, the username/password pair forms the credential set. If authen-
6-14
To Next Page
