Cisco Systems 4500 Debug Commands for DACL

40-39
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Authentication
switchport voice vlan 1234
access-group mode prefer port
ip access-group pacl-4 in
speed 100
duplex full
authentication event fail action authorize vlan 111
authentication event server dead action authorize vlan 333
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order dot1x
authentication port-control auto
authentication timer restart 100
authentication timer reauthenticate 20
authentication timer inactivity 200
mab eap
dot1x pae authenticator
end
Switch#
Switch# show ip access-list pacl-4
10 permit ip host 1.1.1.1 host 2.2.2.2
20 permit icmp host 1.1.1.1 host 2.2.2.2
Switch#
Debug Commands for DACL
The IP device tracking table contains the host IP address learned through ARP or DHCP.
The following command displays the constraints on the IP device tracking table:
Switch# show ip device tracking all
IP Device Tracking = Enabled
IP Device Tracking Probe Count = 3
IP Device Tracking Probe Interval = 30
--------------------------------------------------------------
IP Address MAC Address Interface STATE
--------------------------------------------------------------
50.0.0.12 0015.60a4.5e84 GigabitEthernet2/9 ACTIVE
The following command shows that the Policy Enforced Module (EPM) session contains the
downloadable ACL obtained from ACS:
Switch# show epm session ip 50.0.0.12
Admission feature : DOT1X
AAA Policies :
ACS ACL : xACSACLx-IP-auth-48b79b6e
The following command displays the contents of the downloadable ACL:
Switch# show ip accesslists xACSACLx-IP-auth-48b79b6e
Extended IP access list xACSACLx-IP-auth-48b79b6e (per-user)
10 permit udp any any
Switch(config)#