Per-User Acls And Filter-Ids; Port-Based Authentication Manager Cli Commands - Cisco Catalyst 2960-XR Security Configuration Manual

Configuring IEEE 802.1x Port-Based Authentication

Per-User ACLs and Filter-Ids

ACLs configured on the switch are compatible with other devices running Cisco IOS releases.
You can only set any as the source in the ACL.
Note For any ACL configured for multiple-host mode, the source portion of statement must be any. (For example,
permit icmp any host 10.10.1.1.)

Port-Based Authentication Manager CLI Commands

The authentication-manager interface-configuration commands control all the authentication methods, such
as 802.1x, MAC authentication bypass, and web authentication. The authentication manager commands
determine the priority and order of authentication methods applied to a connected host.
The authentication manager commands control generic authentication features, such as host-mode, violation
mode, and the authentication timer. Generic authentication commands include the authentication host-mode,
authentication violation, and authentication timer interface configuration commands.
802.1x-specific commands begin with the dot1x keyword. For example, the authentication port-control
auto interface configuration command enables authentication on an interface. However, the dot1x
system-authentication control global configuration command only globally enables or disables 802.1x
authentication.
Note If 802.1x authentication is globally disabled, other authentication methods are still enabled on that port,
such as web authentication.
The authentication manager commands provide the same functionality as earlier 802.1x commands.
Beginning with Cisco IOS Release 12.2(55)SE, you can filter out verbose system messages generated by the
authentication manager. The filtered content typically relates to authentication success. You can also filter
verbose messages for 802.1x authentication and MAB authentication. There is a separate command for each
authentication method:
• The no authentication logging verbose global configuration command filters verbose messages from
the authentication manager.
• The no dot1x logging verbose global configuration command filters 802.1x authentication verbose
messages.
• The no mab logging verbose global configuration command filters MAC authentication bypass (MAB)
verbose messages
OL-29434-01
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
Authentication Manager for Port-Based Authentication
219