Configuring A Downloadable Policy - Cisco Catalyst 2960 Software Configuration Manual

Configuring 802.1x Authentication

Configuring a Downloadable Policy

Beginning in privileged EXEC mode:
Command
Step 1 configure terminal
Step 2 access-list access-list-number deny
source source-wildcard log
Step 3 interface interface-id
Step 4 ip access-group acl-id in
Step 5 exit
Step 6
aaa new-model
Step 7 aaa authorization network default
group radius
Step 8 ip device tracking
Step 9 ip device tracking probe [count |
interval | use-svi]
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
10-64
Chapter 10
Purpose
Enter global configuration mode.
Defines the default port ACL by using a source address and wildcard.
The access-list-number is a decimal number from 1 to 99 or 1300 to 1999.
Enter deny or permit to specify whether to deny or permit access if
conditions are matched.
The source is the source address of the network or host that sends a packet,
such as this:
The 32-bit quantity in dotted-decimal format.
•
The keyword any as an abbreviation for source and source-wildcard
•
value of 0.0.0.0 255.255.255.255. You do not need to enter a
source-wildcard value.
The keyword host as an abbreviation for source and source-wildcard
•
of source 0.0.0.0.
(Optional) Applies the source-wildcard wildcard bits to the source.
(Optional) Enters log to cause an informational logging message about the
packet that matches the entry to be sent to the console.
Enter interface configuration mode.
Configure the default ACL on the port in the input direction.
The acl-id is an access list name or number.
Note
Returns to global configuration mode.
Enables AAA.
Sets the authorization method to local. To remove the authorization
method, use the no aaa authorization network default group radius
command.
Enables the IP device tracking table.
To disable the IP device tracking table, use the no ip device tracking
global configuration commands.
(Optional) Configures the IP device tracking table:
count count—Sets the number of times that the switch sends the ARP
•
probe. The range is from 1 to 5. The default is 3.
interval interval—Sets the number of seconds that the switch waits
•
for a response before resending the ARP probe. The range is from 30
to 300 seconds. The default is 30 seconds.
• use-svi—Uses the switch virtual interface (SVI) IP address as source
of ARP probes.
Configuring IEEE 802.1x Port-Based Authentication
OL-26520-01