Configuring the switch to support RADIUS-assigned ACLs

An ACL configured in a RADIUS server is identified by the authentication credentials of the client or group of clients the ACL is designed to support. When a client authenticates with credentials associated with a particular ACL, the switch applies that ACL to the switch port the client is using. To enable the switch to forward a client's credentials to the RADIUS server, you must first configure RADIUS operation and an authentication method on the switch.

  1. Configure RADIUS operation on the switch:
    radius-server host < ipv4-address > key < key-string >

    This command configures the IPv4 address and encryption key of a RADIUS server. The server should be accessible to the switch and configured to support authentication requests from clients using the switch to access the network.

  2. Configure RADIUS network accounting on the switch (optional).
    aaa accounting network {<start-stop | stop-only> radius}

    You can also view ACL counter hits using either of the following commands:

    show access-list radius < port-list >
    show port-access show port-access {<authenticator | mac-based | web-based>} < port-list > clients detailed

    See the documentation provided with your RADIUS server for information on how the server receives and manages network accounting information, and how to perform any configuration steps necessary to enable the server to support network accounting data from the switch.

  3. Configure an authentication method. Options include 802.1X, web-based authentication, and MAC authentication. You can configure 802.1X, web-based authentication, and/or MAC authentication to operate simultaneously on the same ports.
    • 802.1X Option:

      aaa port-access authenticator <port-list>
      aaa authentication port-access chap-radius
      aaa port-access authenticator active

      These commands configure 802.1X port-based access control on the switch, and activates this feature on the specified ports. For more on 802.1X configuration and operation, see User authentication methods.

    • MAC Authentication Option:

      aaa port-access mac-based <port-list>

      This command configures MAC authentication on the switch and activates this feature on the specified ports. For more on MAC authentication, see Web and MAC Authentication.

    • Web Authentication Option:

      aaa port-access web-based <port-list>

      This command configures web-based authentication on the switch and activates this feature on the specified ports. For more on web-based authentication, see Web and MAC Authentication.