Configuring Mac Authentication Bypass With Acl Assignments; Configuring Mac Authentication Bypass With Qos Acls - Cisco WS-C6506 Software Manual

Chapter 41 Configuring MAC Authentication Bypass
Shutdown Timeout
Violation mode
Console> (enable)

Configuring MAC Authentication Bypass with ACL Assignments

MAC authentication bypass(MAB)-enabled ports support ACL assignments similar to 802.1X-enabled
ports. For more information, see
The ACLs must be predefined and committed on the switch. ACL mapping by MAB is a runtime
configuration and does not reflect in the NVRAM. The mapping is removed when the MAB static CAM
entry is removed or at reauth, if the RADIUS sends a different or no ACL to map.

Configuring MAC Authentication Bypass with QoS ACLs

MAC authentication bypass-enabled ports support ACLs sent by RADIUS and QoS policies-based
authentication similar to QoS policies on 802.1X-enabled ports. For more information, see
802.1X with QoS ACLs" section on page
When configuring MAB with QoS ACLs, follow these guidelines:
•
•
•
•
This example shows how to display the QoS ACLs information for a MAB-enabled port:
Console (enable)> show port mac-auth-bypass 3/13
Port
----- --------------------- ----------------- -----------------
3/13 Enabled
Port
----- ------------------ --------------- ------------------
3/13 initialize
Port
----- ----------------------------------------------------------------
3/13
Port
----- -------------------------------- ----------------- ----------------
3/13 my_security_pacl
Port
----- -------------------------------- ----------------------------------
3/13 my_qos_invacl
Port
----- -------- ---------------
3/13 Disabled -
OL-8978-04
The QoS ACLs must be predefined and committed on the switch.
If more than one QoS ACL of the same attribute type (invacl, outvacl, or inpacl) is sent to the MAB
port, only the first ACL for an attribute type is configured.
The minimum acceptable reauthentication timeout for MAB has been reduced to 30 from 300
seconds. The default is 30 seconds.
Dynamically applied QoS ACLs cannot be removed using commands. They are automatically
removed when MAB initializes.
Mac-Auth-Bypass State MAC Address
Termination action Session Timeout Shutdown/Time-Left
3600
PolicyGroups
-
Security ACL
QoS Ingress Policy
Critical Critical-Status
Configuring MAC Authentication Bypass with ACL Assignments
= 60
= Shutdown
"Configuring 802.1X with ACL Assignments" section on page
40-29.
Auth-State
00-11-22-33-01-87 authenticated
NO -
Sec ACL Type
Pacl
QoS Egress Policy
my_qos_outvacl
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
Vlan
-----
391
QoS ACL Type
Vacl
40-26.
"Configuring
41-13