802.1X Authentication With Downloadable Acls And Redirect Urls - Cisco Catalyst 2975 Software Configuration Manual

Understanding IEEE 802.1x Port-Based Authentication
When the port is in the force authorized, force unauthorized, unauthorized, or shutdown state, it is put
into the configured access VLAN.
The 802.1x authentication with VLAN assignment feature is not supported on trunk ports, dynamic
ports, or with dynamic-access port assignment through a VLAN Membership Policy Server (VMPS).
To configure VLAN assignment you need to perform these tasks:
•
•
•
For examples of tunnel attributes, see the
Attributes" section on page

802.1x Authentication with Downloadable ACLs and Redirect URLs

You can download ACLs and redirect URLs from a RADIUS server to the switch during 802.1x
authentication or MAC authentication bypass of the host. You can also download ACLs during web
authentication.
A downloadable ACL is also referred to as a dACL.
Note
If more than one host is authenticated and the host is in single-host, MDA, or multiple-authentication
mode, the switch changes the source address of the ACL to the host IP address.
You can apply the ACLs and redirect URLs to all the devices connected to the 802.1x-enabled port.
If no ACLs are downloaded during 802.1x authentication, the switch applies the static default ACL on
the port to the host. On a voice VLAN port configured in multi-auth or MDA mode, the switch applies
the ACL only to the phone as part of the authorization policies.
Beginning with Cisco IOS Release 12.2(55)SE, if there is no static ACL on a port, a dynamic
auth-default ACL is created, and policies are enforced before dACLs are downloaded and applied.
Catalyst 2975 Switch Software Configuration Guide
10-18
If the VLAN configuration change of one device results in matching the other device configured
–
or assigned VLAN, then authorization of all devices on the port is terminated and multidomain
host mode is disabled until a valid configuration is restored where data and voice device
configured VLANs no longer match.
If a voice device is authorized and is using a downloaded voice VLAN, the removal of the voice
–
VLAN configuration, or modifying the configuration value to dot1p or untagged results in voice
device un-authorization and the disablement of multi-domain host mode.
Enable AAA authorization by using the network keyword to allow interface configuration from the
RADIUS server.
Enable 802.1x authentication. (The VLAN assignment feature is automatically enabled when you
configure 802.1x authentication on an access port).
Assign vendor-specific tunnel attributes in the RADIUS server. The RADIUS server must return
these attributes to the switch:
– [64] Tunnel-Type = VLAN
– [65] Tunnel-Medium-Type = 802
– [81] Tunnel-Private-Group-ID = VLAN name, VLAN ID, or VLAN-Group
[83] Tunnel-Preference
–
Attribute [64] must contain the value VLAN (type 13). Attribute [65] must contain the value 802
(type 6). Attribute [81] specifies the VLAN name or VLAN ID assigned to the 802.1x-authenticated
user.
9-36.
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
"Configuring the Switch to Use Vendor-Specific RADIUS
OL-19720-02