Users Guide

282 Authentication, Authorization, and Accounting
administrator can override the port configuration and add a manually
configured ACL. If the administrator adds an ACL, only the DACL is
removed when the session ends.
The switch alters a dynamic ACL IP address filter configured with the any
keyword for the source IP address. IP source addresses in the DACL are
rewritten to use the supplicant IP address if available. If the IP address is not
available in the IPDT table at the time the ACL is applied and it
subsequently becomes available, the ACL is then rewritten with the source IP
address of the host.
Dynamic ACLs are supported for 802.1X enabled (authentication port-
control auto mode) ports configured in switchport access or general mode.
Only one dynamic IPv4 ACL and one dynamic IPv6 ACL may be associated
with an 802.1X session (for a total of two access-groups per 802.1X session).
Only two named ACLs (one IPv4 and one IPv6) are supported (for a total of
two access groups per 802.1X session) per received Access-Accept.
Dynamic ACLs are supported for ports configured in 802.1X Monitor Mode.
Syntax errors are logged in the Monitor Mode log. Monitor mode behavior is
not altered, for example, if sufficient information to allow access the host to
the port is present, the host is allowed access to the port.
Dynamic ACLs are subject to the same hardware scale limitations as static
ACLs. If the ACL cannot be applied (resource limitation), then the Access-
Accept is treated as an Access-Reject and the port is not authorized. A log
message indicating same is issued (Interface X/X/X not
authorized. ACL received from RADIUS server exceeds
available resources). No Acct-Start packet is sent and an EAP-Failure
is sent to the 802.1X client.
Dynamic ACLs may not exceed the size of a single RADIUS Access-Accept
packet. There is no support for multiple packet ACLs. (Max dynamic ACL is
4000 ASCII characters). There is no support for Downloadable ACLs where
the NAS sends a second Access-Request to the RADIUS server to retrieve an
ACL.
Authentication Examples
It is important to understand that during authentication, all that happens is
that the device is validated. If any attributes are returned from the RADIUS
server, they are not processed during the authentication phase. The attributes