Cisco WS-SUP32-GE-3B Software Configuration Guide - Page 705

Chapter 41 Configuring Network Admission Control Configuring NAC Step 16 Command Router(config)# ip device tracking [probe {count count | interval interval}] Step 17 Step 18 Step 19 Router(config)# eou logging end Router# show ip admission {[cache] [configuration] [eapoudp]} Step 20 Router# show ip device tracking {all | interface interface_id | ip ip_address | mac mac_address} Step 21 Router# show ip access lists interface interface Step 22 Router# copy running-config startup-config Purpose (Optional) Configures these IP device tracking table parameters: • probe count count-Sets the number of times that the switch sends the ARP probe for an entry before removing an entry from the IP device tracking table. The range is from 1 to 5. The default is 3. • probe interval interval-Sets the number of seconds that the switch waits before resending the ARP probe. The range is from 30 to 300 seconds. The default is 30 seconds. (Optional) Enables EAPoUDP system logging events. Returns to privileged EXEC mode. Displays the NAC configuration or network admission cache entries. Displays information about the entries in the IP device tracking table. Displays the downloaded host policies in the Cisco IOS software configuration. (Optional) Saves your entries in the configuration file. To remove the IP NAC rule on the switch, use the no ip admission name rule_name eapoudp global configuration command. To remove the IP NAC rule that was applied to a specific interface, use the no ip admission admission_name interface configuration command. To remove the EAPoUDP authentication methods, use the no aaa authentication eou default global configuration command. To configure the auth-proxy posture code to not obtain security associations from the AAA server, use the no aaa authorization auth-proxy default global configuration command. To disable the IP device tracking table and return the parameters for the table to the default values, use the no device tracking and the no device tracking probe {count | interval} global configuration commands. To configure the switch to not send the Framed-IP-Address attribute, use the no radius-server attribute 8 include-in-access-req global configuration command. To disable the logging of EAPoUDP system events, use the no eou logging global configuration command. To clear all NAC client device entries on the switch or on the specified interface, use the clear eou privileged EXEC command. To clear entries in the IP device tracking table, use the clear ip device tracking privileged EXEC command. This example shows how to configure NAC Layer 2 IP validation on a switch interface: Router# configure terminal Router(config)# ip admission nac eapoudp Router(config)# access-list 5 permit any any Router(config)# interface gigabitethernet 2/0/1 Router(config-if)# ip access-group 5 in Router(config-if)# ip admission name nac Router(config-if)# exit Router(config)# aaa new-model Router(config)# aaa authentication eou default group radius Router(config)# radius-server host admin key rad123 OL-11439-03 Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY 41-15