Cisco Secure Acs And Attribute-Value Pairs For The Redirect Url - Cisco 3032 Software Configuration Manual

Chapter 9 Configuring IEEE 802.1x Port-Based Authentication
If no ACLs are downloaded during 802.1x authentication, the switch applies the static default ACL on
the port to the host. On a voice VLAN port, the switch applies the ACL only to the phone.
If a downloadable ACL or redirect URL is configured for a client on the authentication server, a default
Note
port ACL on the connected client switch port must also be configured.

Cisco Secure ACS and Attribute-Value Pairs for the Redirect URL

The switch uses these cisco-av-pair VSAs:
•
•
The switch uses the CiscoSecure-Defined-ACL AV pair to intercept an HTTP or HTTPS request from
the endpoint device. The switch then forwards the client web browser to the specified redirect address.
The url-redirect AV pair on the Cisco Secure ACS contains the URL to which the web browser is
redirected. The url-redirect-acl AV pair contains the name or number of an ACL that specifies the HTTP
or HTTPS traffic to redirect. Traffic that matches a permit ACE in the ACL is redirected.
Define the URL redirect ACL and the default port ACL on the switch.
Note
If a redirect URL configured for a client on the authentication server, a default port ACL on the
connected client switch port must also be configured.
Cisco Secure ACS and Attribute-Value Pairs for Downloadable ACLs
You can set the CiscoSecure-Defined-ACL Attribute-Value (AV) pair on the Cisco Secure ACS with the
RADIUS cisco-av-pair vendor-specific attributes (VSAs). This pair specifies the names of the
downloadable ACLs on the Cisco Secure ACS with the #ACL#-IP-name-number attribute.
•
•
If a downloadable ACL is configured for a client on the authentication server, a default port ACL on the
connected client switch port must also be configured.
If the default ACL is configured on the switch and the Cisco Secure ACS sends a host-access-policy to
the switch, it applies the policy to traffic from the host connected to a switch port. If the policy does not
apply, the switch applies the default ACL. If the Cisco Secure ACS sends the switch a downloadable
ACL, this ACL takes precedence over the default ACL that is configured on the switch port. However,
if the switch receives an host access policy from the Cisco Secure ACS but the default ACL is not
configured, the authorization failure is declared.
For configuration details, see the
802.1x Authentication with Downloadable ACLs and Redirect URLs" section on page
OL-12247-04
url-redirect is the HTTP to HTTPS URL.
url-redirect-acl is the switch ACL name or number.
The name is the ACL name.
The number is the version number (for example, 3f783768).
Cisco Catalyst Blade Switch 3130 and 3032 for Dell Software Configuration Guide
Understanding IEEE 802.1x Port-Based Authentication
""Authentication Manager" section on page 9-8 and the "Configuring
9-60.
9-19