Login:
Votes - 4, Average rating: 4.3 ( )

User manual Dell, model POWERCONNECT 6200 SERIES

Manafacture: Dell
File size: 1.26 mb
File name: config.pdf
Language of manual:en
Free link for this manual available at the bottom of the page



manual abstract


The RADIUS server informs the switch of the selected VLAN as part of the authentication. Authenticated and Unauthenticated VLANs Hosts that authenticate normally use a VLAN that includes access to network resources. Hosts that fail the authentication might be denied access to the network or placed on a "quarantine" VLAN with limited network access. Much of the configuration to assign hosts to a particular VLAN takes place on the RADIUS server or 802.1X authenticator. If you use an external RADIUS server to manage VLANs, you configure the server to use Tunnel attributes in Access-Accept messages in order to inform the switch about the selected VLAN. These attributes are defined in RFC 2868, and their use for dynamic VLAN is specified in RFC 3580. The VLAN attributes defined in RFC3580 are as follows: • Tunnel-Type = VLAN (13) • Tunnel-Medium-Type = 802 • Tunnel-Private-Group-ID = VLANID VLANID is 12-bits and has a value between 1 and 4093. Guest VLAN The Guest VLAN feature allows a switch to provide a distinguished service to unauthenticated users. This feature provides a mechanism to allow visitors and contractors to have network access to reach external network with no ability to browse information on the internal LAN. In port-based 802.1X mode, when a client that does not support 802.1X is connected to an unauthorized port that is 802.1X-enabled, the client does not respond to the 802.1X requests from the switch. Therefore, the port remains in the unauthorized state, and the client is not granted access to the network. If a guest VLAN is configured for that port, then the port is placed in the configured guest Device Security | 109 VLAN and the port is moved to the authorized state, allowing access to the client. However, if the port is in MAC-based 802.1X authentication mode, it will not move to the authorized state. MAC-based mode makes it possible for both authenticated and guest clients to use the same port at the same time. Client devices that are 802.1X-supplicant-enabled authenticate with the switch when they are plugged into the 802.1X-enabled switch port. The switch verifies the credentials of the client by communicating with an authentication server. If the credentials are verified, the authentication server informs the switch to 'unblock' the switch port and allows the client unrestricted access to the network; i.e., the client is a member of an internal VLAN. Beginning with software release 2.1, Guest VLAN Supplicant mode is configured on a per-port basis. If a client does not attempt authentication on a port and the port is configured for Guest VLAN, the client is assigned to the guest VLAN configured on that port. The port is assigned a Guest VLAN ID and is moved to the authorized status. Disabling the supplicant mode does not clear the ports that are already authorized and assigned Guest VLAN IDs. CLI Examples The following examples show how to configure the switch to accept RADIUS-assigned VLANs and Guest VLANs. The examples assume that the RADIUS server and VLAN information has already been configured on the switch. For information on configuring VLANs, see "Virtual LANs" on page 29. Example #1: Allow the Switch to Accept RADIUS-Assigned VLANs The RADIUS server can place a port in a particular VLAN based on the result of the authentication. The command in this example allows the switch to accept VLAN assignment by the RADIUS server. NOTE: The feature is available in release 2.1 and later. console#config console(config)#aaa authorization network default radius Example #2: Enable Guest VLANs This example shows how to set the guest VLAN on interface 1/g20 to VLAN 100. This command automatically enables the Guest VLAN Supplicant Mode on the interface. NOTE: Define the VLAN before configuring an interface to use it as the guest VLAN. console#configure console(config)#interface ethernet 1/g20 console(config-if-1/g20)#dot1x guest-vlan 100 console(config-if-1/g20)# console#show dot1x advanced ethernet 1/g20 Port Guest Unauthenticated VLAN Vlan 1/g20 Disabled Disabled 110 | Device Security Authentication Server Filter Assignment The PowerConnect 6200 Series switches allow the external 802.1X Authenticator or RADIUS server to assign DiffServ policies to users that authenticate to the switch. When a host (supplicant) attempts to connect to the network through a port, the switch contacts the 802.1X authenticator or RADIUS server, which then provides information to the switch about which DiffServ policy to assign the host (supplicant). The application of the policy is applied to the host after the authentication process has completed. To enable filter assignment by an external server, the following conditions must be true: 1 The port that the host is connected to must be enabled for MAC-based port access control by using the following command in Interface Config mode: dotlx port-control mac-based 2 The RADIUS or 802.1X server must specify the policy to ass...


Reviews



Your review
Your name:
Please, enter two numbers from picture:
capcha





Category