CLI Reference Guide-R04

Chapter 9 | General Security Measures
Web Authentication
– 318 –
Command Usage
When using a bit mask to filter displayed MAC addresses, a 1 means “care” and a 0
means “don't care”. For example, a MAC of 00-00-01-02-03-04 and mask FF-FF-FF-
00-00-00 would result in all MACs in the range 00-00-01-00-00-00 to 00-00-01-FF-
FF-FF to be displayed. All other MACs would be filtered out.
Example
Console#show network-access mac-address-table
Interface MAC Address RADIUS Server Time Attribute
--------- ----------------- --------------- ---------------------- -------
1/1 00-00-01-02-03-04 172.155.120.17 00d06h32m50s Static
1/1 00-00-01-02-03-05 172.155.120.17 00d06h33m20s Dynamic
1/1 00-00-01-02-03-06 172.155.120.17 00d06h35m10s Static
1/3 00-00-01-02-03-07 172.155.120.17 00d06h34m20s Dynamic
Console#
show network-access
mac-filter
Use this command to display information for entries in the MAC filter tables.
Syntax
show network-access mac-filter [filter-id]
filter-id - Specifies a MAC address filter table. (Range: 1-64)
Default Setting
Displays all filters.
Command Mode
Privileged Exec
Example
Console#show network-access mac-filter
Filter ID MAC Address MAC Mask
--------- ----------------- -----------------
1 00-00-01-02-03-08 FF-FF-FF-FF-FF-FF
Console#
Web Authentication
Web authentication allows stations to authenticate and access the network in
situations where 802.1X or Network Access authentication are infeasible or
impractical. The web authentication feature allows unauthenticated hosts to
request and receive a DHCP assigned IP address and perform DNS queries. All other
traffic, except for HTTP protocol traffic, is blocked. The switch intercepts HTTP
protocol traffic and redirects it to a switch-generated web page that facilitates user
name and password authentication via RADIUS. Once authentication is successful,
the web browser is forwarded on to the originally requested web page. Successful
authentication is valid for all hosts connected to the port.