Dell N3200-ON Networking N-Series Switches CLI Reference Guide version 6.8.0 - Page 1086

The switch also accepts the proprietary ACS:CiscoSecure-Defined-ACL AVP. If the ACL does not exist on the switch, the switch attempts to download the ACL from the RADIUS server prior to completing authentication. The ACL name or number in the AVP use the following syntax: #ACL#-IP-namenumber or #ACSACL#. Dynamic ACL Example (Extended syntax, that is, ip access-list extended...) ip:inacl#100=permit ip any 209.165.0.0 0.0.255.255 ip:inacl#110=permit ip any 209.166.0.0 0.0.255.255 ip:inacl#120=permit ip any 209.167.0.0 0.0.255.255 Multiple ip:inacl /ipv6:inacl av-pairs may be present in the RADIUS message. However, only the first definition will be applied for the authentication session. Different sessions, as in the case of the data and voice VLAN authenticating independently, may both have Dynamic ACLs. It is recommended that the DACLs be carefully designed so that they work in harmony, such as, at a minimum, no ACL numbers are duplicated across the DACLs. DACLs are applied at the port level and are capable of affecting any traffic ingressing the port. If there are syntax errors in the received ACLs (other than duplicate rules), the ACL rules are not applied, the RADIUS Access-Accept is treated as an Access-Reject, and a WARN log message or "Interface X/X/X not authorized. Application of downloaded ACL did not complete due to invalid syntax XXXXX" is issued indicating that a received RADIUS rule is misconfigured with invalid syntax or configured with both ip:traffic-class and inacl rules and identifying the affected interface. If Accounting is enabled, the Acct-Start packet is not sent. An EAP-Failure is sent to the 802.1X client. Command History Command introduced in firmware version 6.5.2. retransmit Use the retransmit command in RADIUS Server Configuration mode to specify the number of times the RADIUS client retransmits requests to the RADIUS server. Syntax retransmit retries Security Commands 1086