D-Link NetDefendOS User Manual page 653

that the connection will be dropped after the Idle Timeout period of the RADIUS Relay object has
elapsed, even through traffic has been flowing during that time.
Important: Enable the DHCP server LeasesRequireAuth option
If RADIUS relay is being used in a NetDefendOS configuration, all DHCP servers must be
configured to only distribute leases to configured clients. This is done by enabling the
LeasesRequireAuth property in the CLI and in the Web Interface, enabling the option
Distribute leases only to RADIUS relay authenticated clients.
If this is not done on all DHCP servers, irrespective of whether they are used with RADIUS
relay or not, it could possibly create a security vulnerability and allow an
unauthenticated client access to protected resources.
Radius Relay Object Properties
The important properties of a Radius Relay object are as follows:
• Name
A descriptive name for the object which will be used throughout the configuration.
• DHCP Server
The DHCP server that will be used to hand out IP address leases once the UE is authenticated.
• Source Interface
This is the NetDefendOS interface on which NetDefendOS will listen for AP requests. This can
be any of the following:
i. An Ethernet interface.
ii. A VLAN interface.
iii. An Interface Group.
If the property Override User Data Interface is set, this interface will only listen for the intial
connection from the AP and carry authentication traffic. The interface assigned to Override
User Data Interface will carry the data traffic. This explained further below.
• Client IP Filter
This specifies the source IP range that the AP belongs to. This will typically be a network
range and it is recommended it is specified as a NetDefendOS address book object.
• Listening IP
This is the IP address that the AP will connect to on the Source Interface. If the listening
interface is an Ethernet interface or VLAN it is optional and will default to the IP address of the
interface if not specified.
If the Source Interface is an interface group, the listening IP must be specified.
• Listening Port
This is the listening port number for the listening interface and is 1812 by default.
• Override User Data Interface
653
Chapter 8: User Authentication