• Web authentication with consent Parameter maps are optional. If you do not configure a named parameter map, the software uses the default parameters that are specified in the global parameter map. Per User Inactivity Handling Across Methods A common inactivity aging feature extends support for RADIUS attributes 28 (Idle-Timeout) and attribute 29 (Termination-Action) to web authenticated sessions, providing consistent inactivity handling across all authentication methods, including 802.1x, MAC authentication bypass (MAB), and web authentication. The AAA server sends these attributes as part of the user authorization.
After a session has been idle for the amount of time specified in attribute 28, or has reached the timeout configured with attribute 29, the session is terminated. You can also apply the inactivity timeout and absolute timeout to sessions through a locally defined service template. When enabling the inactivity timeout, you can also enable address resolution protocol (ARP) probes that are sent before the session is terminated. How to Configure Identity Control Policies Enabling the Display Mode for Cisco Identity Based Networking Services Cisco IBNS features are configured in the Cisco common classification policy language (C3PL) display mode.
The legacy authentication manager mode is enabled by default. You can use the following procedure to switch to C3PL display mode and temporarily convert any legacy configuration commands to their C3PL equivalents. This allows you to preview your legacy configuration as a Identity-Based Networking Services configuration before making the conversion permanent. After you enter an explicit Cisco IBNS command, the conversion becomes permanent and you can no longer revert to legacy mode. Procedure Configuring Identity Control Policies Per User Inactivity Handling Across Methods Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode.
• Enter your password if prompted. Step 2 authentication display {legacy | new-style} Example: Device# authentication display new-style Sets the display mode for authentication and policy configuration. • The default display mode is legacy. • You can use this command to switch between legacy and C3PL display mode until you execute the first explicit Identity-Based Networking Services command. After you enter the first explicit Identity-Based Networking Services command, for example when configuring a control class or control policy, the system displays a prompt to confirm whether you Configuring Identity Control Policies 4