Cisco Systems 3560 Manual De Usuario
10-57
Catalyst 3560 Switch Software Configuration Guide
OL-8553-06
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Configuring 802.1x Authentication
Configuring a Downloadable Policy
Beginning in privileged EXEC mode:
Command
Purpose
Step 1
configure terminal
Enter global configuration mode.
Step 2
access-list access-list-number deny
source source-wildcard log
source source-wildcard log
Defines the default port ACL by using a source address and wildcard.
The access-list-number is a decimal number from 1 to 99 or 1300 to 1999.
Enter deny or permit to specify whether to deny or permit access if
conditions are matched.
conditions are matched.
The source is the source address of the network or host that sends a packet,
such as this:
such as this:
•
The 32-bit quantity in dotted-decimal format.
•
The keyword any as an abbreviation for source and source-wildcard
value of 0.0.0.0 255.255.255.255. You do not need to enter a
source-wildcard value.
value of 0.0.0.0 255.255.255.255. You do not need to enter a
source-wildcard value.
•
The keyword host as an abbreviation for source and source-wildcard
of source 0.0.0.0.
of source 0.0.0.0.
(Optional) Applies the source-wildcard wildcard bits to the source.
(Optional) Enters log to cause an informational logging message about the
packet that matches the entry to be sent to the console.
packet that matches the entry to be sent to the console.
Step 3
interface interface-id
Enter interface configuration mode.
Step 4
ip access-group acl-id in
Configure the default ACL on the port in the input direction.
Note
The acl-id is an access list name or number.
Step 5
exit
Returns to global configuration mode.
Step 6
aaa new-model
Enables AAA.
Step 7
aaa authorization network default
group radius
group radius
Sets the authorization method to local. To remove the authorization
method, use the no aaa authorization network default group radius
command.
method, use the no aaa authorization network default group radius
command.
Step 8
ip device tracking
Enables the IP device tracking table.
To disable the IP device tracking table, use the no ip device tracking
global configuration commands.
global configuration commands.
Step 9
ip device tracking probe count count
(Optional) Configures the IP device tracking table:
•
count count–Sets the number of times that the switch sends the ARP
probe. The range is from 1 to 5. The default is 3.
probe. The range is from 1 to 5. The default is 3.
•
interval interval–Sets the number of seconds that the switch waits for
a response before resending the ARP probe. The range is from 30 to
300 seconds. The default is 30 seconds.
a response before resending the ARP probe. The range is from 30 to
300 seconds. The default is 30 seconds.
Step 10
radius-server vsa send authentication
Configures the network access server to recognize and use vendor-specific
attributes.
attributes.
Note
The downloadable ACL must be operational.
Step 11
end
Returns to privileged EXEC mode.