Dell OS6 supports Dynamic ACLs with Redirect-ACLs and URL-Redirect starting with version 6.6.3.0. This can allow devices to be blocked and redirected to remediation pages without the need for a quarantine VLAN.
Below are example configuration commands for Dell OS6 switch:
Note – In this example the NAC RADIUS Server / Policy Server is <NAC-IP> (replace this <NAC-IP> with the IP of your NAC VM)
Note – Replace the VLAN number on the example port configuration with the desired default VLAN for the port.
######################################
# Layer 3 DHCP prerequisites #
######################################
interface vlanX (Layer 3 interface for enforced network)
ip helper-address X.X.X.X (DHCP server)
ip helper-address <NAC-IP> (IP address of NAC Enforcer)
!
######################################
# Layer 2 Switch Configuration #
######################################
# ACL config
ip access-list sc_initial_acl
1000 permit every
exit
ip access-list sc_quarantine_acl
deny udp any any eq domain
deny udp any any eq 67
deny tcp any <NAC-IP> 0.0.0.0 eq http
deny tcp any <NAC-IP> 0.0.0.0 eq 443
deny tcp any <NAC-IP> 0.0.0.0 eq 8443
deny tcp any 198.31.193.211 0.0.0.0 eq http
We can use the command below to check that a device connected to a given port is having the Redirect ACL applied properly.
console# show authentication clients gigabitethernet 1/0/24
Interface...................................... Gi1/0/24
Mac Address.................................... EC:F4:BB:D3:3C:DB
User Name...................................... Tester1
VLAN Assigned Reason........................... RADIUS Assigned VLAN (1774)
Host Mode...................................... multi-auth
Method......................................... 802.1X
Control Mode................................... auto
Session time................................... 37484
Session timeout ............................... 0
Session Termination Action..................... Default
Filter ID......................................
RADIUS Framed IPv4/IPv6 address................
DACL...........................................
Redirect ACL................................... IP-REDIRECT-IN-00000004#d
From NAC:
We can manually input Cisco-AVPair and the value.
Was this page helpful?
Installation