Users Guide

Authentication, Authorization, and Accounting 281
Either traffic-class av-pairs or multiple ip:inacl/ipv6:inacl av-pairs may be
present in the RADIUS message, but not both. If both are present, or there
are syntax errors in the received ACLs (other than duplicate rules), the ACL
rules are not applied, the RADIUS Access-Accept is treated as an Access-
Reject, and a WARN log message or Interface X/X/X not
authorized. Application of downloaded ACL did not
complete due to invalid syntax XXXXX is issued indicating that
a received RADIUS rule is misconfigured with invalid syntax or configured
with both ip:traffic-class and in acl rules, and identifying the RADIUS server
and the affected interface. If Accounting is enabled, the Acct-Start packet is
not sent. An EAP-Failure is sent to the 802.1X client.
The VSAs may appear in any order in the RADIUS message. A mixture of
in/out and IPv4/IPv6 rules may be present in the RADIUS message to be
parsed into the four two Access-Groups. Rules are separated by newlines
(either CR or CR/LF). Upper and lower case shall be accepted. The strings
ip:traffic-class, ip:inacl, ... are always in lower case. The optional digits
following the # symbol indicate the ACL number in the access list.
The rules are applied in the order they appear in the RADIUS packet (the
ACL numbers indicate the relative internal priority). Duplicate entries
(identical number) in the Access-Accept message follow the same behavior as
exists in the UI today (overwrite the previous entry). Conflicting rules are
handled in the same manner as if configured via the CLI.
RADIUS-supplied dynamic ACLS are applied at the access-group level after
removing all statically configured access groups/traffic filters on the port and
before any policies specified in Filter-ID. The following order is observed for
application of the access-groups: IPv6-DACL-IN, IP-DACL-IN, IPv6-V
DACL-IN, IP-V DACL-IN. Empty rules sets are not applied to the port. The
words statically configured access-groups do not include denial of service or
storm control configurations as they use different internal hardware.
The dynamic ACLs exist only for the duration of the 802.1X session. They are
removed when the 802.1X session is terminated (including for COA bounce-
host-port or COA termination requests) or when the port goes down
(unplugged or shut down). Any static ACLs previously removed from the port
are restored when the last 802.1X session ends. Note that the port is
unauthorized when the session ends, so the static rules are not actually
written into hardware. They are available for application if the RADIUS server
does not send an ACL or the port otherwise becomes authorized. The