Brocade Multi-Service IronWare Security Configuration Guide (Supporting R05.6.00) - Manual (Page 326)

308 Multi-Service IronWare Security Configuration Guide
53-1003035-02
Configuring 802.1x port security
8
Dynamically applying existing ACLs or MAC
address filter
When a port is authenticated using 802.1x security, an IP ACL or MAC address filter that exists in
the running configuration on the device can be dynamically applied to the port. To do this, you
configure the Filter-ID (type 11) attribute on the RADIUS server. The Filter-ID attribute specifies the
name or number of the IP ACL or MAC address filter.
The following table shows the syntax for configuring the Filter-ID attribute to refer to a IP ACL or MAC
address filter.
The following table lists examples of values you can assign to the Filter-ID attribute on the RADIUS
server to refer to IP ACLs and MAC address filters configured on a device.
NOTES:
• The name in the Filter ID attribute is case-sensitive.
• You can specify only numbered MAC address filters in the Filter ID attribute. Named
MAC address filters are not supported.
• Dynamic ACL filters are supported for the inbound and outbound direction.
• MAC address filters are supported only for the inbound direction. Outbound MAC
address filters are not supported.
• Dynamically assigned IP ACLs and MAC address filters are subject to the same
configuration restrictions as non-dynamically assigned IP ACLs and MAC address
filters.
Value Description
ip.number.in Applies the specified numbered ACL to the 802.1x
authenticated port in the inbound direction.
ip.name.in Applies the specified named ACL to the 802.1x authenticated
port in the inbound direction.
ip.number.out Applies the specified numbered ACL to the 802.1x
authenticated port in the outbound direction.
ip.name.out Applies the specified named ACL to the 802.1x authenticated
port in the outbound direction.
mac.number.in Applies the specified MAC address filter to the 802.1x
authenticated port in the inbound direction.
Possible values for the filter ID attribute on the
RADIUS server ACL or MAC address filter configured on the device
ip.2.in access-list 2 permit host 10.48.0.3
access-list 2 permit 10.0.0.0 10.255.255.255
ip.102.in access-list 102 permit ip 10.0.0.0 10.255.255.255 any
ip.fdry_filter.in ip access-list standard fdry_filter
permit host 10.48.0.3
mac.401.in access-list 401 permit 3333.3333.3333 ffff.ffff.ffff any etype any
mac.402.in
mac.403.in access-list 402 permit 3333.3333.3333 ffff.ffff.ffff any etype any
access-list 403 permit 2222.2222.2222 ffff.ffff.ffff any etype any