Filter
Top Products
10-9
Catalyst 2960 and 2960-S Switch Software Configuration Guide
OL-8603-09
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
Per-User ACLs and Filter-Ids
In releases earlier than Cisco IOS Release 12.2(50)SE, per-user ACLs and filter Ids were only supported
in single-host mode. In Cisco IOS Release 12.2(50), support was added for MDA- and multiauth-enabled
ports. In 12.2(52)SE and later, support was added for ports in multihost mode.
In releases earlier than Cisco IOS Release 12.2(50)SE, an ACL configured on the switch is not
compatible with an ACL configured on another device running Cisco IOS software, such as a
Catalyst 6000 switch.
In Cisco IOS Release 12.2(50)SE or later, the ACLs configured on the switch are compatible with other
devices running the Cisco IOS release.
Note You can only set any as the source in the ACL.
Note For any ACL configured for multiple-host mode, the source portion of statement must be any. (For
example, permit icmp any host 10.10.1.1.)
You must specify any in the source ports of any defined ACL. Otherwise, the ACL cannot be applied and
authorization fails. Single host is the only exception to support backward compatibility.
More than one host can be authenticated on MDA- enabled and multiauth ports. The ACL policy applied
for one host does not effect the traffic of another host.
If only one host is authenticated on a multi-host port, and the other hosts gain network access without
authentication, the ACL policy for the first host can be applied to the other connected hosts by specifying
any in the source address.
NAC Layer 2 IP validation Filter-Id attribute
3
Downloadable ACL
Redirect URL
Filter-Id attribute
3
Downloadable ACL
Redirect URL
Filter-Id attribute
3
Downloadable ACL
Redirect URL
Filter-Id attribute
3
Downloadable
ACL
3
Redirect URL
3
Web authentication as fallback
method
5
Proxy ACL
Filter-Id attribute
3
Downloadable
ACL
3
Proxy ACL
Filter-Id attribute
3
Downloadable
ACL
3
Proxy ACL
Filter-Id attribute
3
Downloadable
ACL
3
Proxy ACL
3
Filter-Id attribute
3
Downloadable
ACL
3
1. MDA = Multidomain authentication.
2. Also referred to as multiauth.
3. Supported in Cisco IOS Release 12.2(50)SE and later.
4. Supported in Cisco IOS Release 12.2(50)SE and later.
5. For clients that do not support 802.1x authentication.
Table 10-1 802.1x Features (continued)
Authentication method
Mode
Single Host Multiple Host MDA
1
Multiple
Authentication
2