Radius Relay - D-Link NetDefendOS User Manual

• No extra IP rule is required for either DNS traffic or authentication traffic. The IP rule that
allows data to flow from the client to the backbone is the only one required.
Example 8.8. Radius Relay
This example shows how to configure a Radius Relay object for the scenario illustrated below.
Here, client devices (UE) must access data services through a backbone network via an Access
Point (AP). First, they must be authenticated against a RADIUS server and then allocated an IP
address. The AP is connected to the physical If1 Ethernet interface of a NetDefend Firewall and
the backbone network is connected to the If2 interface.
The following assumptions are made:
• Two VLANs are already configured and these NetDefendOS objects are called vlan_auth for
client authentication traffic and vlan_data for data traffic flowing to the backbone.
• Both these VLANs are already set up to run over the physical Ethernet interface If1 and that
the AP has also been correctly configured to use the appropriate VLAN for authentication and
data.
• Authenticated users must belong to the group called ue_group.
• A Radius Relay object called r_relay1 will be created which will listen for authentication
requests on the vlan_auth interface and relay them to a RADIUS server with the IPv4 address
radius_ip. The scenario is illustrated in the diagram below.
• After successful authentication, IP address leases will be handed out by a DHCP server object
called rr_dhcp_server. It is assumed the UEs will be allocated addresses belonging to the
network 192.168.10.10-192.168.10.255 that will be defined in an IPv4 address object called
client_net.
• After successful authentication, UEs will be granted access to a backbone network on the If2
interface using an IP rule called client_access_rule.
Command-Line Interface
A. Create the IP4Address object that defines the range of client IP addresses for the UEs and
assign it the authentication group called ue_group:
655
Chapter 8: User Authentication