Roaming; Radius Redundancy; Rejection And Failure; Additional Radius Attributes - Extreme Networks Summit WM Technical Reference Manual

MAC Based Authentication

Roaming

When a client roams from one Wireless AP to another, the MAC authentication is not required by
default. The MAC authentication can be forced in the roaming case. It could happen that the user re-
authentication is not required, but that the MAC re-authentication is.

Radius redundancy

If the primary server for the MAC authentication is not accessible, the radius redundancy will be
triggered and the request will be sent to the next server. The expected behavior is similar to the
description in the RADIUS redundancy documents.

Rejection and failure

There is a difference in handling rejection and failure.
Rejection is when the MAC address is rejected by the RADIUS servers.
Initially, the Radius server timeout was treated as rejection (MU_NOT_ALLOWED), but it has been
changed. If the vnMgr does not receive a reply within the specified time, it will not send rejection to the
MU Session Manager. Instead, it will send different message indicating authentication failure
(MU_AUTH_ERROR). The same occurs for the timeout from the other components in the chain:
Radius client timeout
●
Security manager timeout
●
VnManager timeout
●
In order to avoid processing continuous request of unauthorized clients, the feature includes instant
rejection by Wireless AP for defined duration, after which the record will be completely deleted and
new authentication process may proceed. The rejected clients will not be in the black list, since the black
list applies to all WM-ADs, while the restriction for a MAC-based authentication is WM-AD based.
For the MU association, if the MU Session Manager does not get a reply from the vnMgr within the 30
sec, it will send the failure to Wireless AP. Since the vnMgr can get another request from the same
client, it will have different ID and the first reply will be dropped.

Additional RADIUS attributes

The access_accept may include the session timeout, which will be applied to the pre-authenticated
session timer. It also may include the re-direction URL, which should be included in the filter
definitions for the WM-AD.
116
Summit WM Technical Reference Guide, Software Version 5.1