Per user ACL with dot1x wired

[will.shaw]

Is it possible to apply a per-user ACL from ACS3.2 to a wired 802.1x port on a 3560?

I have got dot1x authentication and vlan assignment working perfectly, when looking at the debug it says it sucessfully applied the per-user acl; however the user can still access everything. is there something I am missing?

[jafrazie]

Did you configure the ACL on the backend RADIUS server?

After the port is authorized, perform a "show access-lists". You should see the ACL, with an asterisk indication that it's a per-user ACL, that's been applied dynamically (which will disappear when the port becomes unauthorized).

Hope this helps.