Access Security Guide K/KA/KB.15.15

Table 14 Application of RADIUS-Assigned Values
Application of dynamic RADIUS
assignment
Static per-port setting optionsDynamic RADIUS assignment options
Applies per-client; that is, only to client
whose authentication triggered the
assignment. (Up to 32 clients supported
per-port.)
qos priority <0 - 7>802.1p Priority (CoS)
rate-limit <all | bcast |
icmp | mcast> in <kbps |
percent>
Inbound (Ingress) Rate-Limiting
Applies per-port; that is, to all clients
on the port.
1
rate-limit <all | bcast |
icmp | mcast> out <kbps |
percent>
Outbound (Egress) Rate-Limiting
1
Uses the value assigned to the port by the most recent instance of client authentication.
Syntax:
show port-access
web-based clients [port-list] detail
mac-based clients [port-list] detail
authenticator clients [port-list] detail
If the switch receives an 802.1p priority (CoS) and/or rate-limit setting(s) from a
RADIUS server as the result of a client authentication on a port, the above commands
display the assigned values while the client's session is active. When the session
ends, the values for that client are no longer displayed.
The priority and inbound (ingress) rate-limit are applied only to the inbound traffic
of the client whose authentication triggered the assignment. The outbound (egress)
rate-limit applies to all outbound traffic on the port.
web-based [port-list] clients detail
Displays, for a Web authenticated client (web-based authentication), the status of
RADIUS-assignment details for that client. See “Viewing status of ports enabled for
web-based authentication” (page 91).
mac-based [port-list] clients detail
Displays, for a MAC authenticated client (MAC-Auth), the status of
RADIUS-assignment details for that client.
authenticator [port-list] clients detail
Displays, for an 802.1X- authenticated client, the status of RADIUS-assignment
details for that client.
Example
Suppose port 4 has been statically configured from the CLI with the following:
• 802.1p priority: 7
• Inbound rate-limit: 50 percent
• Outbound rate-limit: 50 percent
The above, statically configured, per-port priority and inbound rate-limit settings
will not apply to any clients who authenticate and receive different inbound priority
and rate-limit settings from the RADIUS server. If the RADIUS server also assigns an
outbound rate-limit setting, which is applied per-port instead of per-client, then the
outbound traffic from the port to all connected clients will be rate-limited according
to the value set by the server for the most recently authenticated client. Thus, if client
Viewing 201