You cannot configure a MAC ACL and web-based authentication on the same interface. You cannot configure web-based authentication on a port whose access VLAN is configured for VACL capture. EtherChannel You can configure web-based authentication on a Layer 2 EtherChannel interface. The web-based authentication configuration applies to all member channels. How to Configure Web-Based Authentication Default Web-Based Authentication Configuration The following table shows the default web-based authentication configuration. Table 1:
Default Web-based Authentication Configuration Default Setting Feature Disabled AAA RADIUS server • None specified • IP address • None specified • UDP authentication port • Key 3600 seconds Default value of inactivity timeout Enabled Inactivity timeout Web-Based Authentication Configuration Guidelines and Restrictions • Web-based authentication is an ingress-only feature. • You can configure web-based authentication only on access ports. Web-based authentication is not supported on trunk ports, EtherChannel member ports, or dynamic trunk ports. • External web authentication, where the switch redirects a client to a particular host or web server for displaying login message, is not supported.
• You cannot authenticate hosts on Layer 2 interfaces with static ARP cache assignment. These hosts are not detected by the web-based authentication feature because they do not send ARP messages. • By default, the IP device tracking feature is disabled on a switch. You must enable the IP device tracking feature to use web-based authentication. • You must enable SISF-Based device tracking to use web-based authentication. By default, SISF-Based device tracking is disabled on a switch. Web-Based Authentication EtherChannel Web-Based Authentication 10