Dell EMC Configuration Guide for the S3100 Series 9.14.2.4

Configuration notes

Consider the following when configuring RADIUS-assigned DACL in the switch:

• RADIUS-assigned DACLs are applicable only for the inbound traffic on a specific port of the switch or supplicant.
• NAS supports unique session based on RADIUS-assigned DACLs using the MAC address of the 802.1x client.
• RADIUS-assigned DACLs and ACLs configured through the OS9 CLI can coexist. RADIUS-assigned DACLs takes higher precedence over the L3 ACL configured using OS9 CLI.
• IPv6 NAS-Filter-Rule attributes are not supported as part of Radius-assigned DACLs.
• Change of Authorization (CoA) Action requests on the RADIUS NAS-Filter-Rule Attributes are not supported.
• The attributes in RADIUS NAS-Filter-Rule supports only the L3 options.
• The RADIUS-assigned DACLs are implicit permit. You can configure an implicit deny rule deny ip any any explicitly to block all other traffic.
• The maximum size of the RADIUS-assigned DACLs through NAS-Filter-Rule attribute is 4000 characters. It can be a single rule or multiple rules.
• The names of ACLs configured using the OS9 CLI must be different from the name of the RADIUS-assigned DACLs downloaded from the RADIUS server.
• After switch failover, you must do the following on the interface before changing any dot1x related configurations:
  1. Shutdown the interface using shutdown command
  2. UP the interface using no shutdown command