Switch Supplicant With Network Edge Access Topology (Neat) - Cisco ME 3400 Software Configuration Manual

Chapter 8 Configuring IEEE 802.1x Port-Based Authentication
To configure VLAN assignment you need to perform these tasks:
•
•
•
For examples of tunnel attributes, see the
Attributes" section on page
802.1x Switch Supplicant with Network Edge Access Topology (NEAT)
NEAT extends identity to areas outside the wiring closet (such as conference rooms) through the
following:
•
•
•
OL-9639-07
Enable AAA authorization by using the network keyword to allow interface configuration from the
RADIUS server.
Enable IEEE 802.1x. (The VLAN assignment feature is automatically enabled when you configure
IEEE 802.1x on an access port).
Assign vendor-specific tunnel attributes in the RADIUS server. The RADIUS server must return
these attributes to the switch:
[64] Tunnel-Type = VLAN
–
– [65] Tunnel-Medium-Type = 802
– [81] Tunnel-Private-Group-ID = VLAN name or VLAN ID
Attribute[64] must contain the value VLAN (type 13). Attribute[65] must contain the value 802 (type
6). Attribute[81] specifies the VLAN name or VLAN ID assigned to the IEEE 802.1x-authenticated
user.
7-29.
802.1x switch supplicant: You can configure a switch to act as a supplicant to another switch by
using the 802.1x supplicant feature. This configuration is helpful in a scenario where, for example,
a switch is outside a wiring closet and is connected to an upstream switch through a trunk port. A
switch configured with the 802.1x switch supplicant feature authenticates with the upstream switch
for secure connectivity.
Host Authorization: NEAT ensures that only traffic from authorized hosts (connecting to the switch
with supplicant) is allowed on the network. The switches use Client Information Signalling Protocol
(CISP) to send the MAC addresses connecting to the supplicant switch to the authenticator switch,
as shown in Figure 8-4.
Auto enablement: Automatically enables trunk configuration on the authenticator switch, allowing
user traffic from multiple VLANs coming from supplicant switches. This can be achieved by
configuring the cisco-av-pair as device-traffic-class=switch at the ACS. (You can configure this
under the group or user settings.)
Understanding IEEE 802.1x Port-Based Authentication
"Configuring the Switch to Use Vendor-Specific RADIUS
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide
8-9