Switch 2960s does not support port-based ACLs to implement dot1x with Cisco ISE.

[KevinYounil1]

Hi everyone,

I am implementing Cisco ISE 2.4 in LAB environment with a 2960S switch. I am trying to apply a default ACL on access ports to allow DNS and DC access before dot1x authentication. Unfortunately, the existing image does not support port-based ACLs.  Does anyone know which IOS image should I use for this switch to implement dot1X with Cisco ISE?

Existing image is: c2960s-universalk9-mz.152-2.E9.bin

Any help in this regard is highly appreciated.

Thanks,

Kevin 

[ognyan.totev]

Hi , i don't understand what mean does not support ,share please with us some port configuration .

[Damien Miller · Accepted solution]

This is a known limitation with LAN lite which I suspect you have and you need a LAN base switch for port acls. I remember from the past that you couldn't switch between lite and base on the 2960.

What does "show license" say?

[ognyan.totev]

@Damien MillerI think you are right i don't have problems with mine 2960

Model number                    : WS-C2960X-48FPS-L

Feature: lanbase
        Period left: Life time
        License Type: Permanent
        License State: Active, In Use
        License Priority: Medium
        License Count: Non-Counted

This is mine switch and i have no problem with it

[KevinYounil1]

Thanks Damien,

Do you know which IOS image can I use to resolve this issue?

[Damien Miller]

You can't upgrade a LAN Lite 2960 to LAN Base, it is fixed when it leaves the factory.

[KevinYounil1]

Great, Thank you very much.

[Mohammed al Baqari]

This is the 1st time to haer that you can't put ACL on port. What happens
if you type 'ip access-g ?' in the port. ? Post the output of show license
feature.

[KevinYounil1]

When I run ip access-group command, it says this image does not support port-based ACLs. I will attach the output of show license tonight since I don't have access to it now.