######################################
# Layer 3 DHCP prerequisites #
######################################
interface vlanX (Layer 3 interface for enforced network)
ip helper-address X.X.X.X (DHCP server)
ip helper-address <NAC-IP> (IP address of MetaAccess NAC Enforcer)
!
######################################
# Layer 2 Switch Configuration #
######################################
# ACL config
ip access-list sc_initial_acl
1000 permit every
exit
ip access-list sc_quarantine_acl
deny udp any any eq domain
deny udp any any eq 67
deny tcp any <NAC-IP> 0.0.0.0 eq http
deny tcp any <NAC-IP> 0.0.0.0 eq 443
deny tcp any <NAC-IP> 0.0.0.0 eq 8443
deny tcp any 198.31.193.211 0.0.0.0 eq http
deny tcp any 198.31.193.211 0.0.0.0 eq 443
deny tcp any 198.31.193.211 0.0.0.0 eq 8443
permit every
exit
# RADIUS config
aaa accounting dot1x default start-stop radius
aaa accounting update periodic 5
authentication enable
authentication dynamic-vlan enable
dot1x system-auth-control
aaa authentication dot1x default radius
aaa authorization network default radius
!
aaa server radius dynamic-author
client <NAC-IP> server-key XXXX
auth-type any
exit
!
radius server auth <NAC-IP>
name "Default-RADIUS-Server"
usage authmgr
key XXXX
exit
!
radius server acct <NAC-IP>
name "Default-RADIUS-Server"
key XXXX
exit
!
radius server vsa send authentication
!
ip device tracking
!
# HTTP/HTTPS Must be enabled for url-redirect VSAs from the NAC to have desired effect.
ip http server
ip http secure-server
# Uplink ports and other ports except for test port (NAC enforcement will not be applied)
interface GiX/X/X
dot1x port-control force-authorized
authentication port-control force-authorized
exit
!
# Port for initial test client and later for other clients (NAC enforcement will be applied)
interface GiY/Y/Y (client test port)
switchport mode general
authentication port-control auto
authentication host-mode multi-auth
authentication max-users 2
authentication periodic
dot1x timeout tx-period 15
dot1x max-reauth-req 1
authentication order dot1x
exit
copy running-config startup-config
####################################################################
# Examples of other types of ACL exceptions (if required): #
####################################################################
remark allow PXE boot
deny udp any host x.x.x.x eq tftp
deny udp any host x.x.x.x range 1025 5000
remark allow authentication to domain controller
deny tcp any host x.x.x.x eq 53
deny udp any host x.x.x.x eq 53
deny tcp any host x.x.x.x eq 88
deny udp any host x.x.x.x eq 88
deny udp any host x.x.x.x eq 123
deny tcp any host x.x.x.x eq 135
deny udp any host x.x.x.x eq 137
deny tcp any host x.x.x.x eq 139
deny tcp any host x.x.x.x eq 389
deny udp any host x.x.x.x eq 389
deny tcp any host x.x.x.x eq 445
deny udp any host x.x.x.x eq 445
deny tcp any host x.x.x.x eq 3268
