KB.15.15

Effect of RADIUS-assigned ACLs when multiple clients are using the same port

Some network configurations may allow multiple clients to authenticate through a single port where

a RADIUS server assigns a separate, RADIUS-assigned ACL in response to each client's

authentication on that port. In such cases, a given client's inbound traffic will be allowed only if

the RADIUS authentication response for that client includes a RADIUS-assigned ACL. For example,

in Figure 226 (page 309), clients A through D authenticate through the same port (B1) on an 8212zl

switch running software release K.14.01 or greater.

Figure 226 Multiple clients authenticating through a single port

In this case, the RADIUS server must be configured to assign a RADIUS-assigned ACL to port B1

each time any of the clients authenticates on the port.

802.1X User-Based and Port-Based applications

User-Based 802.1X access control allows up to 32 individually authenticated clients on a given

port. Port-Based access control does not set a client limit, and requires only one authenticated client

to open a given port, and is recommended for applications where only one client at a time can

connect to the port.

• If you configure 802.1X user-based security on a port and the RADIUS response includes a

RADIUS-assigned ACL for at least one authenticated client, then the RADIUS response for all

other clients authenticated on the port must also include a RADIUS-assigned ACL. Inbound IP

traffic on the port from a client that authenticates without receiving a RADIUS-assigned ACL

will be dropped and the client will be de-authenticated.

• Using 802.1X port-based security on a port where the RADIUS response to a client

authenticating includes a RADIUS-assigned ACL, different results can occur, depending on

whether any additional clients attempt to use the port and whether these other clients initiate

an authentication attempt. This option is recommended for applications where only one client

at a time can connect to the port, and not recommended for instances where multiple clients

may access the same port at the same time. For more information, see “802.1X Port-based

access control” (page 338).

Operating notes

• For RADIUS ACL applications using software release K.14.01 or greater, the switch operates

in a dual-stack mode, and a RADIUS-assigned ACL can filter both IPv4 and IPv6 traffic. At a

minimum, a RADIUS-assigned ACL automatically includes the implicit deny for both IPv4 and

IPv6 traffic. Thus, an ACL configured on a RADIUS server to filter IPv4 traffic will also deny

inbound IPv6 traffic from an authenticated client unless the ACL includes ACEs that permit the

desired IPv6 traffic. The reverse is true for a dynamic ACL configured on RADIUS server to

Overview 309