Cisco WS-SUP32-GE-3B Software Configuration Guide - Page 708

Configuring NAC Chapter 41 Configuring Network Admission Control To configure NAC AAA down policy, perform this task: Command Purpose Step 1 Router# configure terminal Enters global configuration mode. Step 2 Router(config)# ip admission name rule-name eapoudp event timeout aaa policy identity identity_policy_name Creates a NAC rule and associates an identity policy to be applied to sessions, when the AAA server is unreachable. To remove the rule on the switch, use the no ip admission name rule-name eapoudp event timeout aaa policy identity global configuration command. Step 3 Router(config)# access-list access-list-number {deny | permit} source [source-wildcard] [log] Defines the default port ACL by using a source address and wildcard. The access-list-number is a decimal number from 1 to 99 or 1300 to 1999. Enter deny or permit to specify whether to deny or permit access if conditions are matched. The source is the source address of the network or host from which the packet is being sent specified as follows: • The 32-bit quantity in dotted-decimal format. • The keyword any as an abbreviation for source and source-wildcard value of 0.0.0.0 255.255.255.255. You do not need to enter a source-wildcard value. • The keyword host as an abbreviation for source and source-wildcard of source 0.0.0.0. (Optional) Applies the source-wildcard wildcard bits to the source. (Optional) Enters log to cause an informational logging message about the packet that matches the entry to be sent to the console. Step 4 Step 5 Step 6 Router(config-if)# interface interface-id Router(config-if)# ip access-group {access-list-number | name} in Router(config-if)# ip admission name rule-name Enters interface configuration mode. Controls access to the specified interface. Applies the specified IP NAC rule to the interface. To remove the IP NAC rule that was applied to a specific interface, use the no ip admission rule-name interface configuration command. Step 7 Router(config)# exit Returns to global configuration mode. Step 8 Router(config)# aaa new-model Enables AAA. Step 9 Router(config)# aaa authentication eou default group radius Sets authentication methods for EAPoUDP. To remove the EAPoUDP authentication methods, use the no aaa authentication eou default global configuration command. Step 10 Router(config)# aaa authorization network default local Sets the authorization method to local. To remove the authorization method, use no aaa authorization network default local command. Step 11 Router(config)# ip device tracking Enables the IP device tracking table. To disable the IP device tracking table, use the no ip device tracking global configuration commands. 41-18 Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY OL-11439-03