47
Enhancements
Release M.10.02 Enhancements
Table 4. Contrasting Dynamic and Static ACLs
RADIUS-Based (Dynamic) ACLs
Port-Based (Static) ACLs
Operates on the 3400cl switches.
Operates on both the 3400cl and 6400cl switches.
Configured in client accounts on a RADIUS server.
Configured in the switch itself.
Designed for use on the edge of the network where
filtering of inbound traffic is most important and where
clients with differing access requirements are likely
to use the same port at different times.
Designed for general use where the filtering needs for
the traffic to the switch from connected devices is
predictable and largely static.
Implementation requires client authentication.
Client authentication not a factor.
Instead of an ACL name or number, the ACL is defined
by the credentials (username/password pair or the
MAC address) of the specific client the ACL is
intended to service. Thus, all ACEs configured in the
RADIUS server with the same client identifiers
comprise the ACL for the specified client.
Identified by a number in the range of 1-199 or an
alphanumeric name.
Supports dynamic assignment to filter only the
inbound IP traffic from an authenticated client on the
port to which the client is connected. (Traffic can be
routed or switched, and includes traffic having a DA
on the switch itself.)
Supports static assignments to filter traffic from a
connected device, and operates in applictions that
may or may not include 802.1X or other types of client
authentication.
When the authenticated client session ends, the
switch removes the RADIUS-assigned ACL from the
client port.
Remains statically assigned to the ports unless
removed by a
no interface <
port-list
> access-group
CLI command.
Supports one RADIUS-based ACL on a port.
Supports one inbound ACL per-port.
The ACL filters the IP traffic received inbound from the
client whose authentication resulted in the ACL
assignment. Inbound traffic from any other source is
denied.
An ACL applied inbound on a port filters all IP traffic
received.
Requires client authentication by a RADIUS server
configured to dynamically assign an ACL to the client
port, based on client credentials.
Configured in the switch and statically applied to filter
all inbound IP traffic on the specified ports.
ACEs allow a counter (
cnt
) option that causes a
counter to increment when there is a packet match.
ACEs allow a
log
option that generates a log message
whenever there is a packet match with a “deny” ACE.
