Configuring RADIUS Server Support for Switch Services

Configuring and Using RADIUS-Assigned Access Control Lists

RADIUS-assigned ACLs

Static Port ACLs

 

 

Allows one RADIUS-assigned ACL per authenticated client on a port. (Each such ACL filters traffic from a different, authenticated client.)

Note: The switch provides ample resources for supporting RADIUS-assigned ACLs and other features. However, the actual number of ACLs supported depends on the switch’s current feature configuration and the related resource requirements. For more information, refer to the appendix titled “Monitoring Resources” in the Management and Configuration Guide for your switch.

Supports only extended ACLs. (Refer to Terminology.)

A given RADIUS-assigned ACL filters only the IP traffic entering the switch from the authenticated client corresponding to that ACL, and does not filter IP traffic inbound from other authenticated clients.(The traffic source is not a configurable setting.)

A given RADIUS-assigned ACL operates on a port to filter only the IP traffic entering the switch from the authenticated client corresponding to the ACL, and does not filter IP traffic inbound from other authenticated clients. (The traffic source is not a configurable setting.)

ACEs allow a counter (cnt) option that causes a counter to increment when there is a packet match.

Supports static ACLs

Supports standard and extended ACLs

A static port ACL applied on a port filters all traffic entering the switch through that port.

No client authentication requirement.

ACEs allow a log option that generates a log message whenever there is a packet match with a “deny” ACE.

Caution Regardingthe Use of Source

Routing

Source routing is enabled by default on the switch and can be used to override ACLs. For this reason, if you are using ACLs to enhance network security, the recommended action is to use the no ip source-routecommand to disable source routing on the switch. (If source routing is disabled in the running­ config file, the show running command includes “no ip source-route” in the running-config file listing.)

How a RADIUS Server Applies a RADIUS-Assigned ACL to a Switch Port

A RADIUS-assigned ACL configured on a RADIUS server is identified and invoked by the unique credentials (username/password pair or a client MAC address) of the specific client the ACL is designed to service. Where the username/password pair is the selection criteria, the corresponding ACL can also be used for a group of clients that all require the same ACL policy and use

6-14