This document describes the IP device monitoring feature, the triggers to add and take away a bunch, and the affect of gadget monitoring on the 802.1x DACL. This document describes how the IP machine tracking characteristic works, which includes what the triggers are to add and remove a host. Also, the impression of device tracking on the 802.1x Downloadable Access Control List (DACL) is defined. The behavior modifications between versions and iTagPro technology platforms. The second part of the doc focuses on the Access Control List (ACL) returned by the Authentication, Authorization, and Accounting (AAA) server and iTagPro technology applied to the 802.1x session. A comparability between the DACL, Per-User ACL and Filter-ID ACL is presented. Also, some caveats in regards to the ACL rewrite and default ACL are discussed. Address Resolution Protocol (ARP) request (reads the sender MAC handle and the sender IP handle from the ARP packet). That performance is typically called ARP inspection, however it isn't the same as Dynamic ARP Inspection (DAI).

That function is enabled by default and iTagPro technology cannot be disabled. Additionally it is known as ARP snooping, but debugs don't present it after "debug arp snooping" is enabled. ARP snooping is enabled by default and can't be disabled or iTagPro technology managed. Device tracking removes an entry when there isn't any response for an ARP request (sending probe for every host within the gadget tracking table, by default each 30 seconds). There is the problem when you've an ARP response, ItagPro but the device monitoring entry is removed anyway. That bug appears to be in Version 12.2.33 and has not appeared in Version 12.2.Fifty five or 15.x software. Also there are some variations when handling with the L2 port (access-port) and L3 port (no switchport). In this example, the Pc has been configured with a static IP address. 2), the device tracking entry is updated. So every ARP request from the Pc updates the machine tracking desk (the sender MAC deal with and sender IP tackle from the ARP packet).

It is very important do not forget that a number of the features akin to DACL for 802.1x usually are not supported in the LAN Lite version (beware - Cisco Feature Navigator does not all the time present the correct data). The hidden command from Version 12.2 might be executed, ItagPro however has no impact. After removal of 802.1x configuration from the port, IPDT can also be faraway from that port. The port status is presumably be "DOWN", so it's essential to have "switchport mode entry" and "authenticaion port-control auto" so as to have IP machine tracking activated on that port. Also, iTagPro geofencing there are not any limits for maximum entries per port (zero means disabled). If 802.1x is configured with DACL, the system tracking entry is used so as to fill the IP address of machine. For auth proxy, one unique ACL from the ACS is cached and proven with the show ip access-listing command and a particular (Per-User with specific IP) ACL is utilized on the interface with the show ip access-list interface fa0/1 command.

However, auth-proxy doesn't use gadget IP tracking. What if the IP handle will not be detected correctly? On this scenario, machine tracking for 802.1x is not required. The one distinction is that understanding the IP handle of the client upfront can be used for a RADIUS access-request. Take into account that TrustSec also wants IP system tracking for IP to SGT bindings. What is the difference between Version 15.x and iTagPro smart device Version 12.2.Fifty five in DACL? In software program Version15.x, iTagPro technology it really works the same as for auth-proxy. The generic ACL will be seen when the present ip entry-record command is entered (cached response from AAA), but after the show ip entry-list interface fa0/1 command, the src "any" is replaced by the source IP deal with of the host (recognized via IP machine tracking). The cellphone is authenticated through MAC Authentication Bypass (MAB), ItagPro while the Pc uses dot1x. However, when verified on the interface degree the supply has been changed by the IP handle of the gadget.

Edit

Pub: 13 Sep 2025 11:53 UTC

Views: 11