Cisco Systems 2960-S, 2960 Per-User ACLs and Filter-Ids

10-9
Catalyst 2960 and 2960-S Switch Software Configuration Guide
OL-8603-09
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
Per-User ACLs and Filter-Ids
In releases earlier than Cisco IOS Release 12.2(50)SE, per-user ACLs and filter Ids were only supported
in single-host mode. In Cisco IOS Release 12.2(50), support was added for MDA- and multiauth-enabled
ports. In 12.2(52)SE and later, support was added for ports in multihost mode.
In releases earlier than Cisco IOS Release 12.2(50)SE, an ACL configured on the switch is not
compatible with an ACL configured on another device running Cisco IOS software, such as a
Catalyst 6000 switch.
In Cisco IOS Release 12.2(50)SE or later, the ACLs configured on the switch are compatible with other
devices running the Cisco IOS release.
Note You can only set any as the source in the ACL.
Note For any ACL configured for multiple-host mode, the source portion of state ment must be any. (For
example, permit icmp any host 10.10.1.1.)
You m u st sp ec if y any in the so urce ports of any defined ACL. Otherwise, the ACL cannot be applied and
authorization fails. Single host is the only exception to support backward compatibility.
More than one host can be authenticated on MDA- enabled and multiauth ports. The ACL policy applied
for one host does not effect the traffic of another host.
If only one host is authenticated on a multi-host port, and the other hosts gain network access without
authentication, the ACL policy for the first host can be applied to the other connected hosts by specifying
any in the source address.
NAC Layer 2 IP validation Filter-Id attribute3
Downloadable ACL
Redirect URL
Filter-Id attribute3
Downloadable ACL
Redirect URL
Filter-Id attribute3
Downloadable ACL
Redirect URL
Filter-Id attribute3
Downloadable
ACL3
Redirect URL3
Web authentication as fallback
method5
Proxy ACL
Filter-Id attribute3
Downloadable
ACL3
Proxy ACL
Filter-Id attribute3
Downloadable
ACL3
Proxy ACL
Filter-Id attribute3
Downloadable
ACL3
Proxy ACL3
Filter-Id attribute3
Downloadable
ACL3
1. MDA = Multidomain authentication.
2. Also referred to as multiauth.
3. Supported in Cisco IOS Release 12.2(50)SE and later.
4. Supported in Cisco IOS Release 12.2(50)SE and later.
5. For clients that do not support 802.1x authentication.
Table 10-1 802.1x Features (continued)
Authentication method
Mode
Single Host Multiple Host MDA1
Multiple
Authentication2