topic Re: Switch 2960s does not support port-based ACLs to implement dot1x with Cisco ISE. in Network Access Control

Switch 2960s does not support port-based ACLs to implement dot1x with Cisco ISE.

KevinYounil1 — Thu, 03 Jan 2019 05:11:29 GMT

Hi everyone,

I am implementing Cisco ISE 2.4 in LAB environment with a 2960S switch. I am trying to apply a default ACL on access ports to allow DNS and DC access before dot1x authentication. Unfortunately, the existing image does not support port-based ACLs. Does anyone know which IOS image should I use for this switch to implement dot1X with Cisco ISE?

Existing image is: c2960s-universalk9-mz.152-2.E9.bin

Any help in this regard is highly appreciated.

Thanks,

Kevin

Re: Switch 2960s does not support port-based ACLs to implement dot1x with Cisco ISE.

ognyan.totev — Thu, 03 Jan 2019 06:36:10 GMT

Hi , i don't understand what mean does not support ,share please with us some port configuration .

Re: Switch 2960s does not support port-based ACLs to implement dot1x with Cisco ISE.

Damien Miller — Thu, 03 Jan 2019 06:47:21 GMT

This is a known limitation with LAN lite which I suspect you have and you need a LAN base switch for port acls. I remember from the past that you couldn't switch between lite and base on the 2960.

What does "show license" say?

Re: Switch 2960s does not support port-based ACLs to implement dot1x with Cisco ISE.

ognyan.totev — Thu, 03 Jan 2019 06:52:50 GMT

@Damien MillerI think you are right i don't have problems with mine 2960

Model number : WS-C2960X-48FPS-L

Feature: lanbase
        Period left: Life time
        License Type: Permanent
        License State: Active, In Use
        License Priority: Medium
        License Count: Non-Counted

This is mine switch and i have no problem with it

Re: Switch 2960s does not support port-based ACLs to implement dot1x with Cisco ISE.

Mohammed al Baqari — Thu, 03 Jan 2019 08:00:16 GMT

This is the 1st time to haer that you can't put ACL on port. What happens
if you type 'ip access-g ?' in the port. ? Post the output of show license
feature.

Re: Switch 2960s does not support port-based ACLs to implement dot1x with Cisco ISE.

KevinYounil1 — Thu, 03 Jan 2019 15:04:43 GMT

When I run ip access-group command, it says this image does not support port-based ACLs. I will attach the output of show license tonight since I don't have access to it now.

Re: Switch 2960s does not support port-based ACLs to implement dot1x with Cisco ISE.

KevinYounil1 — Thu, 03 Jan 2019 16:58:34 GMT

Thanks Damien,

Do you know which IOS image can I use to resolve this issue?

Re: Switch 2960s does not support port-based ACLs to implement dot1x with Cisco ISE.

Damien Miller — Thu, 03 Jan 2019 17:03:04 GMT

You can't upgrade a LAN Lite 2960 to LAN Base, it is fixed when it leaves the factory.

Re: Switch 2960s does not support port-based ACLs to implement dot1x with Cisco ISE.

KevinYounil1 — Thu, 03 Jan 2019 18:46:59 GMT

Great, Thank you very much.