Cisco Catalyst 2960 Series, Configuration Manual

Page: 1511 / 2288

AAA Accounting with Authentication Proxy
Using the authentication proxy, you can generate “ start ” and “ stop ” accounting records with enough information
to be used for billing and security auditing purposes. Thus, you can monitor the actions of authenticated hosts
that use the authentication proxy service.
When an authentication proxy cache and associated dynamic access control lists (ACLs) are created, the
authentication proxy will start to track the traffic from the authenticated host. Accounting saves data about
this event in a data structure stored with the data of other users. If the accounting start option is enabled, you
can generate an accounting record (a
“ start ” record) at this time. Subsequent traffic from the authenticated
host will be recorded when the dynamic ACL created by the authentication proxy receives the packets.
When an authentication proxy cache expires and is deleted, additional data, such as elapsed time, is added to
the accounting information and a
“ stop ” record is sent to the server. At this point, the information is deleted
from the data structure.
The accounting records for the authentication proxy user session are related to the cache and the dynamic
ACL usage.
ACLs
If you configure a VLAN ACL or a Cisco IOS ACL on an interface, the ACL is applied to the host traffic
only after the web-based authentication host policy is applied.
For Layer 2 web-based authentication, it is more secure, though not required, to configure a port ACL (PACL)
as the default access policy for ingress traffic from hosts connected to the port. After authentication, the
web-based authentication host policy overrides the PACL. The Policy ACL is applied to the session even if
there is no ACL configured on the port.
You cannot configure a MAC ACL and web-based authentication on the same interface.
You cannot configure web-based authentication on a port whose access VLAN is configured for VACL
capture.
Context-Based Access Control
Web-based authentication cannot be configured on a Layer 2 port if context-based access control (CBAC) is
configured on the Layer 3 VLAN interface of the port VLAN.
EtherChannel
You can configure web-based authentication on a Layer 2 EtherChannel interface. The web-based authentication
configuration applies to all member channels.
Gateway IP
You cannot configure Gateway IP (GWIP) on a Layer 3 VLAN interface if web-based authentication is
configured on any of the switch ports in the VLAN.
You can configure web-based authentication on the same Layer 3 interface as Gateway IP. The host policies
for both features are applied in software. The GWIP policy overrides the web-based authentication host policy.
LAN Port IP
You can configure LAN port IP (LPIP) and Layer 2 web-based authentication on the same port. The host is
authenticated by using web-based authentication first, followed by LPIP posture validation. The LPIP host
policy overrides the web-based authentication host policy.
If the web-based authentication idle timer expires, the NAC policy is removed. The host is authenticated, and
posture is validated again.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1429
Information About Web-Based Authentication