44-9
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 44 Configuring Network Admission Control
Configuring Network Admission Control with LAN Port IP
c.
Define other policy statements using policy groups that correspond to various LAN port IP states as
follows:
set security acl ip NACACL permit ip group healthy_hosts any
set security acl ip NACACL deny ip group infected_hosts any
set security acl ip NACACL permit ip group exception_hosts any
set security acl ip NACACL permit ip group clientless_hosts host 10.76.39.100
d.
For URL redirection, apply this ACE at an appropriate position:
set security acl ip NACACL permit url-redirect
Step 5
For clientless nonresponsive hosts (NRH hosts), enable the clientless functionality by entering the
set
eou allow clientless enable
command.
Step 6
Define a policy for NRH hosts. The specified groups should also be present in the ACL that is defined
in the previous steps:
set policy name
exception_policy
group
exception_hosts
Step 7
Specify an exception host and assign the policy by entering the
set eou authorize ip 77.0.0.90 policy
exception_policy
command.
Step 8
Configure the RADIUS server. For RADIUS server configuration details, refer to the
Implementing
Network Admission Control Phase One Configuration and Deployment
publication at this URL:
http://www.cisco.com/application/pdf/en/us/guest/netsol/ns466/c654/cdccont_0900aecd80217e26.pdf
Ensure that the policy groups that are used in the ACLs are configured with the posture-token VSA, such
as 26/9/1 sec:pg=healthy_hosts.
If you define a policy group in ACS but the VACL that is mapped to the VLAN does not refer to that
group, posture validation will fail because the policy installation fails.
Step 9
Ensure that the sc0 interface is configured with a proper IP address by entering these commands:
set interface
{
sc0
|
sl0
|
sc1
} {
up
|
down
}
set interface sc0
[
vlan
] [
ip_addr
/
netmask
[
broadcast
]]
Step 10
Ensure that there is a default router in the VLAN to which the host is connected. If there is no default
router, you need a static ARP on the host for the sc0 IP address.
Step 11
If the host and the management interface (sc0) are in the same VLAN, and you have a VACL configured
for that VLAN, you should configure an ACE to allow traffic to the RADIUS server from the switch IP
address.
LAN Port IP CLI Command Examples
This section describes how to configure the LAN port IP CLI:
•
Enabling or Disabling LAN Port IP Globally, page 44-10
•
Enabling or Disabling the Bypassing of LAN Port IP Posture Validation for Clientless Hosts,
page 44-11
•
Statically Authorizing an IP Address as an Exception Host Device and Applying a Policy to the
Device, page 44-11
