Users Guide

390 Authentication, Authorization, and Accounting
Filter-id (11) = “internet_access”
If it is desired that an existing ACL be configured, include the following
attribute in the RADIUS server configuration:
Filter-ID(11) = "Existing_ACL.in"
• The ACL or DiffServ policy specified in the attribute must already be
configured on the switch, and the ACL names must be identical to the one
sent by the RADIUS server with an ".in" suffix.
For information about configuring a DiffServ policy, see "DiffServ
Configuration Examples" on page 1556. For information about configuring
a Dynamic ACL, see "Dynamic ACL Overview" on page 314. The example
"Providing Subnets Equal Access to External Network" on page 1556,
describes how to configure a policy named internet_access.
If you use an authentication server to assign ACLs or DiffServ policies to an
authenticated user, note the following guidelines:
• If the policy or ACL specified within the server Filter-ID attribute does not
exist on the switch, authentication will fail.
• Do not delete policies or ACLs used as the Filter-ID by the RADIUS server
while 802.1X is enabled.
• Do not use the DiffServ service-policy command to apply the filter to an
interface if you configure the RADIUS server or 802.1X authenticator to
assign the DiffServ filter.
In the following example, Company XYZ uses IEEE 802.1X to authenticate
all users. Contractors and temporary employees at Company XYZ are not
permitted to have access to SSH ports, and data rates for Web traffic is
limited. When a contractor is authenticated by the RADIUS server, the server
assigns a DiffServ policy to control the traffic restrictions.
The network administrator configures two DiffServ classes:
cl-ssh and cl-http .
The class
cl-ssh matches all incoming SSH packets. The class cl-http matches
all incoming HTTP packets. Then, the administrator configures a traffic
policy called
con-pol and adds the cl-ssh and cl-http . The policy is configured
so that SSH packets are to be dropped, and HTTP data rates are limited to 1
MB with a burst size of 64 Kbps. HTTP traffic that exceeds the limit is
dropped. The host ports, ports 1–23, are configured to use single-host host
mode. Finally, the administrator configures the RADIUS server with the
attribute Filter-id (11)= “con-pol” (steps not shown).