Configuring A Downloadable Policy - Cisco IE-4000 Software Configuration Manual

Configuring IEEE 802.1x Port-Based Authentication
How to Configure IEEE 802.1x Port-Based Authentication

Configuring a Downloadable Policy

Command
1. configure terminal
2. access-list access-list-number deny
source [source-wildcard log]
3. interface interface-id
4. ip access-group acl-id in
5. exit
6. aaa new-model
7. aaa authorization network default group
radius
8. ip device tracking
9. ip device tracking probe [count |
interval | use-svi]
10. radius-server vsa send authentication
Purpose
Enters global configuration mode.
Defines the default port ACL by using a source address and wildcard.
The access-list-number is a decimal number from 1 to 99 or 1300 to
1999.
deny or permit—Specifies whether to deny or permit access if conditions
are matched.
source—Specifies the source address of the network or host that sends a
packet:

The 32-bit quantity in dotted-decimal format.

The keyword any as an abbreviation for source and source-wildcard
value of 0.0.0.0 255.255.255.255. You do not need to enter a
source-wildcard value.

The keyword host as an abbreviation for source and source-wildcard
of source 0.0.0.0.
(Optional) source-wildcard—Applies the wildcard bits to the source.
(Optional) log—Creates an informational logging message about the
packet that matches the entry to be sent to the console.
Enters interface configuration mode.
Configures the default ACL on the port in the input direction.
Note: The acl-id is an access list name or number.
Returns to global configuration mode.
Enables AAA.
Sets the authorization method to local. To remove the authorization
method, use the no aaa authorization network default group radius
command.
Enables the IP device tracking table.
To disable the IP device tracking table, use the no ip device tracking
global configuration commands.
(Optional) Configures the IP device tracking table:

count count—Sets the number of times that the switch sends the ARP
probe. The range is from 1 to 5. The default is 3.

interval interval—Sets the number of seconds that the switch waits for
a response before resending the ARP probe. The range is from 30 to
300 seconds. The default is 30 seconds.

use-svi—Uses the switch virtual interface (SVI) IP address as source
of ARP probes.
Configures the network access server to recognize and uses
vendor-specific attributes.
Note: The downloadable ACL must be operational.
232