Radius Filter-Id Attribute And Dynamic Policy Profile Assignment - Enterasys SecureStack C2 Configuration Manual

Overview of Security Methods
authenticate and grant appropriate access to end user devices communicating with
SecureStack C2 ports. For details on using CLI commands to configure 802.1X, refer to
"Configuring 802.1X Authentication" on page 18‐9.
• MAC Authentication – provides a mechanism for administrators to securely authenticate
source MAC addresses and grant appropriate access to end user devices communicating with
SecureStack C2 ports. For details, refer to "Configuring MAC Authentication" on page 18‐19.
• Multiple Authentication Methods – allows users to authenticate using multiple methods of
authentication on the same port. For details, refer to "Configuring Multiple Authentication
Methods" on page 18‐30.
• Multi‐User Authentication – On the SecureStack C2, the only type of multiple user
authentication supported is "User + IP Phone". The User + IP Phone authentication feature
supports authentication and authorization of two devices, specifically a PC cascaded with an
IP phone, on a single port on the C2. The IP phone must authenticate using MAC or 802.1X
authentication, but the user may authenticate by any method. This feature allows both the
user's PC and IP phone to simultaneously authenticate on a single port and each receive a
unique level of network access. For details, refer to "Configuring Multi‐User Authentication
(User + IP phone)" on page 18‐30.
• RFC 3580 Tunnel Attributes provide a mechanism to contain an 802.1X authenticated user to a
VLAN regardless of the PVID. Up to six users can be configured per Gigabit port. Refer to
"Configuring VLAN Authorization (RFC 3580)" on page 18‐41.
• MAC Locking – locks a port to one or more MAC addresses, preventing the use of
unauthorized devices and MAC spoofing on the port For details, refer to "Configuring MAC
Locking" on page 18‐46.
• Port Web Authentication (PWA) – locks down a port a user is attached to until after the user
logs in using a web browser to access the switch. The switch will pass all login information
from the end station to a RADIUS server for authentication before turning the port on. PWA is
an alternative to 802.1X and MAC authentication. For details, refer to "Configuring Port Web
Authentication (PWA)" on page 18‐57.
• Secure Shell (SSH) – provides secure Telnet. For details, refer to "Configuring Secure Shell
(SSH)" on page 18‐68.
• IP Access Lists (ACLs) – permits or denies access to routing interfaces based on protocol and
inbound and/or outbound IP address restrictions configured in access lists. For details, refer to
"Configuring Access Lists" on page 18‐70.

RADIUS Filter-ID Attribute and Dynamic Policy Profile Assignment

If you configure an authentication method that requires communication with a RADIUS server,
you can use the RADIUS Filter‐ID attribute to dynamically assign a policy profile and/or
management level to authenticating users and/or devices.
The RADIUS Filter‐ID attribute is simply a string that is formatted in the RADIUS Access‐Accept
packet sent back from the RADIUS server to the switch during the authentication process.
18-2 Security Configuration
Note: To configure EAP pass-through, which allows client authentication packets to be forwarded
through the switch to an upstream device, 802.1X authentication must be globally disabled with the
set dot1x command.
Note: C2 devices support up to eight authenticated users per port.