802.1X Low-Impact Mode

With low-impact mode, you are able to strengthen the security stance by adding an ingress ACL to the 802.1X-enabled switch port that is configured in open mode. This ACL provides the ability to maintain whatever basic connectivity is required for unauthenticated hosts.

This procedure can be used to provide a host that is attached to a default port with the ability to use DHCP, DNS, and perhaps get to the Internet, while blocking access to internal resources.

When a device connected to that switch port authenticates, an appropriate authorization policy can be applied. Options for authorization policies include downloadable ACLs, dynamic VLAN assignment or security group tags.

• Limited, basic access prior to authentication
  1. Port ACL applied to the switch interface
  2. Default port ACL, if no interface ACL exists
• Grant specific access after successful authentication
  1. dACL received from server

interface GigabitEthernet 0/1
 authentication host-mode multi-auth
 authentication open
 authentication port-control auto
 mab
 dot1x pae authenticator
 ip access-group default-ACL in