Quick Reference Guide

944 PowerConnect B-Series TI24X Configuration Guide
53-1002269-02
Configuring 802.1X port security
28
Notes
• The <name> in the Filter ID attribute is case-sensitive.
• You can specify only numbered MAC address filters in the Filter ID attribute. Named MAC
address filters are not supported.
• Dynamic ACL filters are supported only for the inbound direction. Dynamic outbound ACL
filters are not supported.
• MAC address filters are supported only for the inbound direction. Outbound MAC address
filters are not supported.
• Dynamically assigned IP ACLs and MAC address filters are subject to the same configuration
restrictions as non-dynamically assigned IP ACLs and MAC address filters.
Configuring per-user IP ACLs or MAC address filters
Per-user IP ACLs and MAC address filters make use of the Vendor-Specific (type 26) attribute to
dynamically apply filters to ports. Defined in the Vendor-Specific attribute are Dell ACL or MAC
address filter statements. When the RADIUS server returns the Access-Accept message granting a
client access to the network, the Dell device reads the statements in the Vendor-Specific attribute
and applies these IP ACLs or MAC address filters to the client port. When the client disconnects
from the network, the dynamically applied filters are no longer applied to the port. If any filters had
been applied to the port previous to the client connecting, then those filters are reapplied to the
port.
NOTE
Dynamic IP ACL filters and MAC address filters are not supported on the same port at the same time.
The following table shows the syntax for configuring the Dell Vendor-Specific attributes with ACL or
MAC address filter statements.
The following table shows examples of IP ACLs and MAC address filters configured in the Dell
Vendor-Specific attribute on a RADIUS server. These IP ACLs and MAC address filters follow the
same syntax as other Dell ACLs and MAC address filters. Refer to the related chapters in this book
for information on syntax.
mac.2.in mac filter 2 permit 3333.3333.3333 ffff.ffff.ffff any etype eq 0800
mac.2.in
mac.3.in
mac filter 2 permit 3333.3333.3333 ffff.ffff.ffff any etype eq 0800
mac filter 3 permit 2222.2222.2222 ffff.ffff.ffff any etype eq 0800
Table 9:
Value Description
ipACL.e.in=<extended-ACL-entries> Applies the specified extended ACL entries to the 802.1X
authenticated port in the inbound direction.
macfilter.in=<mac-filter-entries> Applies the specified MAC address filter entries to the 802.1X
authenticated port in the inbound direction.
Table 8:
Possible values for the filter ID attribute on the
RADIUS server
ACL or MAC address filter configured on the Dell device