Configuring NAC

Prerequisite

You need to complete the NAC configuration on both AAA server and PICA8 switch when employ NAC function. The following section describes how configure NAC on PICA8 switch. For details about how to configure NAC on AAA server, please refer to the following documents in Typical Configuration of NAC:

• Configuring Dynamic and Downloadable ACL for ClearPass
• Configuring Dynamic and Downloadable ACL on Cisco ISE
• Configuring Pica8 Switches with ClearPass Guest Central Web Authentication
• Integrating Pica8 Switches with Cisco ISE

Procedure

Step1         Configure VLAN.

    a)      Create a VLAN.

    set vlans vlan-id <vlan-id>

    b)     Configure the interface to VLAN.

    set interface gigabit-ethernet <port> family ethernet-switching native-vlan-id <vlan-id>

    c)     Configure the IP address of the VLAN.

    set l3-interface vlan-interface <interface-name> address <address> prefix-length <number>

    d)     Associate a Layer 3 interface with a VLAN.

    set vlans vlan-id <vlan-id> l3-interface <interface-name>

Step2         Configure IP address for RADIUS authentication server and the shared key.

    set protocols dot1x aaa radius authentication server-ip <ip-address> [shared-key <key-string>]

Step3         (Optional) Configure the UDP port for RADIUS authentication server and accounting server.

   set protocols dot1x aaa radius authentication server-ip <ip-address> auth-port <port-number>

   set protocols dot1x aaa radius authentication server-ip <ip-address> acct-port <port-number>

Step4         Configure the DNS serve IP address. This step is required for Web authentication.

   set system dns-server-ip <dns-server-ip>

Step5         Configure the NAS IP address to the L3 interface IP which is connected to the AAA server.

                    set protocols dot1x aaa radius nas-ip <ip-address>

    This command is used to set the nas-ip field in RADIUS access-request message. It can be the IP address of a VLAN interface, eth0, routed interface or sub-interface.

Step6         Configure the authentication mode.

    set protocols dot1x interface <interface-name> auth-mode 802.1x

    set protocols dot1x interface <interface-name> auth-mode mac-radius

    set protocols dot1x interface <interface-name> auth-mode web

Step7         Configure block VLAN. This step is required for Web authentication.

    a)      Configure block VLAN ID.

    set protocols dot1x block-vlan-id <block-vlan-id>

    b)      Configure the interface to VLAN.

    set interface gigabit-ethernet <port> family ethernet-switching native-vlan-id <vlan-id>

    c)      Configure the IP address of block VLAN interface.

    set l3-interface vlan-interface <interface-name> address <address> prefix-length <number>

    d)      Associate a Layer 3 interface with block VLAN.

    set vlans vlan-id <block-vlan-id> l3-interface <interface-name>

Step8         Configure a RADIUS dynamic authorization client from which the switch accepts Change of Authorization (CoA) messages. This step is required for CoA and Web authentication.

    set protocols dot1x aaa radius dynamic-author client <client-ip> shared-key <key-string>

Step9         (Optional) Configure the UDP port of the RADIUS dynamic authorization server of CoA function. This is the UDP port on the switch side.

    set protocols dot1x aaa radius dynamic-author client <client-ip> port <port-number>

Step10        Configure host mode for NAC authentication interface.

    set protocols dot1x interface <interface-name> host-mode <single | multiple>

Step11       Configure dynamic ACL on the switch.

    a)      Configure the filter conditions.

    set protocols dot1x filter <filter-name> sequence <sequence-number> from <filter-condition>

    b)      Configure the filter action.

    set protocols dot1x filter <filter-name> sequence <number> then action <discard | forward>

Step12        (Optional) Configure a server fail VLAN on the switch.

    set protocols dot1x server-fail-vlan-id <vlan-id>

Step13        (Optional) Enable fallback to WEB function.

    set protocols dot1x interface <interface-name> auth-mode 802.1x fallback-to-web disable <true |false>

Step14        (Optional) Enable open authentication function on a specified interface.

    set protocols dot1x interface <interface-name> authentication-open disable <true | false>

Step15        (Optional) You can use either one of the following two commands to configure the maximum number of NAC sessions that are allowed to be established on the port enabled for NAC. 

                     By default, there is no limit on the number of NAC sessions.

     set protocols dot1x interface <interface-name> max-sessions <max-sessions-number>

                    set protocols dot1x max-sessions-per-port <max-sessions-number>

Step16        Commit the configuration.

    commit