44-8
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 44 Configuring Network Admission Control
Configuring Network Admission Control with LAN Port IP
Configuring LAN Port IP
This section describes how to configure LAN port IP.
Note
To display LAN port IP configuration information and to clear LAN port IP configuration elements, see
the
“LAN Port IP CLI Command Examples” section on page 44-9
. To configure policy-based ACLs
(PBACLs), see the
“Configuring Policy-Based ACLs” section on page 44-21
.
Note
For assistance in following these configuration steps, see the
“LAN Port IP Configuration Example”
section on page 44-30
.
To configure LAN port IP, perform these steps:
Step 1
Enable LAN port IP globally on the switch by entering the
set eou
{
enable | disable
} command (the
default is disabled).
Console> (enable)
set eou enable
EoU globally enabled.
Console> (enable)
Step 2
Enable LAN port IP on a per-port basis by entering the
set port eou
mod
/
port
{
bypass | auto | disable
| initialize | revalidate
} command.
Console> (enable)
set port eou 7/1 auto
EoU enabled on 7/1
Console> (enable)
Step 3
Define the RADIUS server and RADIUS key by entering the following commands:
set radius server
ip_addr
[
auth-port
port
] [
acct-port
port
] [
primary
]
set radius key
key
This example shows how to define the RADIUS server:
Console> (enable)
set radius server 10.76.39.93 auth-port 1812 primary
10.76.39.93 with auth-port 1812 acct-port 1813 added to radius server table as primary
server.
Console> (enable)
This example shows how to define the RADIUS key:
Console> (enable)
set radius key cisco
Radius key set to cisco
Console> (enable)
Step 4
Define a policy-based ACL (PBACL) and map it to a VLAN as follows:
a.
Enable DHCP snooping and/or ARP inspection:
set security acl ip
acl-name
permit dhcp-snooping
set security acl ip
acl-name
permit arp-inspection
b.
Enable EAPoUDP redirection:
set security acl ip
acl-name
permit eapoudp
