Cisco Catalyst 4500 Series, Руководство по настройке программного обеспечения

Страница: 1333 / 2086

49-53
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 49 Configuring 802.1X Port-Based Authentication
Configuring 802.1X Port-Based Authentication
The following example illustrates how to configure a switch for downloadable policy:
Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# aaa new-model
Switch(config)# aaa authorization network default local
Switch(config)# ip device tracking
Switch(config)# ip access-list extended default_acl
Switch(config-ext-nacl)# permit ip any any
Switch(config-ext-nacl)# exit
Switch(config)# int fastEthernet 2/13
Switch(config-if)# ip access-group default_acl in
Switch(config-if)# exit
Configuring RADIUS-Provided Session Timeouts
You can configure the Catalyst 4500 series switch to use a RADIUS-provided reauthentication timeout.
To configure RADIUS-provided timeouts, perform this task:
Step 4
Switch(config-if)# ip access-group
{ access-list-number | name } in
Controls access to the specified interface.
This step is mandatory for a functioning downloaded policy.
Step 5
Switch(config)# exit
Returns to global configuration mode.
Step 6
Switch ( config ) # aaa new-model
Enables AAA.
Step 7
Switch ( config ) #
aaa authorization
network default local
Sets the authorization method to local. To remove the authorization
method, use the
no aaa authorization network default local command.
Step 8
Switch ( config ) # ip device tracking
Enables the IP device tracking table.
To disable the IP device tracking table, use the no ip device tracking
global configuration commands.
Step 9
Switch ( config ) # ip device tracking
[
probe
{
count
count | interval
interval }]
(Optional) Configures these parameters for the IP device tracking table:
•
count— Number of times that the switch sends the ARP probe. The
range is 1 to 5. The default is 3.
• interval— Number of seconds that the switch waits for a response
before resending the ARP probe. The range is 30 to 300 seconds. The
default is 30 seconds.
Step 10
Switch ( config ) # ip device tracking
[ probe { delay interval }]
(Optional) Configures the optional probe delay parameter for the IP
device tracking table:
• interval —Number of seconds that the switch delays sending an ARP
probe, triggered by link-up and ARP probe generation by the tracked
device. The range is 1 to 120 seconds. The default is 0 seconds.
Step 11
Switch ( config ) # end Returns to privileged EXEC mode.
Step 12
Switch# show ip device tracking
{ all | interface interface-id | ip
ip-address | mac mac-address }
Displays information about the entries in the IP device tracking table.
Step 13
Switch# copy running-config
startup-config
(Optional) Saves your entries in the configuration file.
Command Purpose