Policy Examples; Policies And Radius Support; Radius Attributes; Authentication-Based Network Access Example - Extreme Networks Summit 300-48 Software User's Manual

Policy Examples

The following examples suggest typical uses of network security policies.
Example. You want to give employees complete network access but limit access to visitors. The
solution is to base network access on the authentication method, as indicated in Table 47.
Table 47: Authentication-Based Network Access Example
Authentication Method
802.1x with dynamic WEP
TKIP with pre-shared keys
WEP
Fails 802.1x authentication Deny access
NOTE
Not all methods can be used at the same time on the same interface.
Example. You want to restrict user access to certain locations or times. The solution is to include the
Altitude 300 as a component of network access and include time restrictions for certain locations.

Policies and RADIUS Support

The authentication features of the Summit 300-48 switch are tightly integrated with RADIUS. You can
specify the following types of RADIUS access control policies:
• User-based — 802.1x requests provide the RADIUS server with the user name and password. Based
on the user name, the RADIUS server sends back authentication information, including allow/deny,
assigned VLAN, and VLAN tag.
• Location-based — You can configure a location string for each wireless port. The location is sent to
the RADIUS server as a vendor-specific attribute. The RADIUS server uses this information to
determine the access policy.

RADIUS Attributes

Table 48 lists the attributes included in each request for access:
Table 48: RADIUS Request Attributes
Attribute
User-Name
User-Password
Service-Type
Vendor-Specific
Summit 300-48 Switch Software User Guide
User Placement
Internal VLAN
PSK VLAN
WEP VLAN
Description
User name for dot1x or MAC address
User-specified for dot1x or blank
Value is login (1)
Contains EXTREME_USER_LOCATION, and the value is as configured
by the user for the location of each wireless port
Network Security Policies for Wireless Interfaces
109