Brocade TurboIron 24X Series Configuration Guide - Manual (Page 994)

960 Brocade TurboIron 24X Series Configuration Guide
53-1003053-01
Configuring 802.1X port security
Syntax: [no] dot1x disable-filter-strict-security
The output of the show dot1x and show dot1x config commands has been enhanced to indicate
whether strict security mode is enabled or disabled globally and on an interface. Refer to
“Displaying 802.1X multiple-host authentication information” on page 975.
Dynamically applying existing ACLs or MAC address filters
When a port is authenticated using 802.1X security, an IP ACL or MAC address filter that exists in
the running-config on the device can be dynamically applied to the port. To do this, you configure
the Filter-ID (type 11) attribute on the RADIUS server. The Filter-ID attribute specifies the name or
number of the Brocade IP ACL or MAC address filter.
The following is the syntax for configuring the Filter-ID attribute to refer to an Brocade IP ACL or MAC
address filter.
The following table lists examples of values you can assign to the Filter-ID attribute on the RADIUS
server to refer to IP ACLs and MAC address filters configured on a device.
Notes
• The in the Filter ID attribute is case-sensitive.
• You can specify only numbered MAC address filters in the Filter ID attribute. Named MAC
address filters are not supported.
• Dynamic ACL filters are supported only for the inbound direction. Dynamic outbound ACL
filters are not supported.
• MAC address filters are supported only for the inbound direction. Outbound MAC address
filters are not supported.
Table 6:
Value Description
ip.<number>.in Applies the specified numbered ACL to the 802.1X authenticated port in the inbound
direction.
ip.<name>.in Applies the specified named ACL to the 802.1X authenticated port in the inbound
direction.
mac.<number>.in Applies the specified numbered MAC address filter to the 802.1X authenticated port in
the inbound direction.
Table 7:
Possible values for the filter ID attribute on the
RADIUS server ACL or MAC address filter configured on the device
ip.2.in access-list 2 permit host 10.48.0.3
access-list 2 permit 10.0.0.0 0.255.255.255
ip.102.in access-list 102 permit ip 10.0.0.0 0.255.255.255 any
ip.fdry_filter.in ip access-list standard fdry_filter
permit host 10.48.0.3
mac.2.in mac filter 2 permit 3333.3333.3333 ffff.ffff.ffff any etype eq 0800
mac.2.in
mac.3.in mac filter 2 permit 3333.3333.3333 ffff.ffff.ffff any etype eq 0800
mac filter 3 permit 0000.0022.2222 ffff.ffff.ffff any etype eq 0800