Edge-Core ECS4620-28T Quick Start Manual page 307

◆
◆
◆
◆
◆
◆
Configuring
MAC address authentication is configured on a per-port basis, however there are
two configurable parameters that apply globally to all ports on the switch. Use the
Global Settings for
Security > Network Access (Configure Global) page to configure MAC address
Network Access
authentication aging and reauthentication time.
Parameters
These parameters are displayed:
◆
For example, if the attribute is "service-policy-in=p1;service-policy-in=p2", then
the switch applies only the DiffServ profile "p1. "
Any unsupported profiles in the Filter-ID attribute are ignored.
For example, if the attribute is "map-ip-dscp=2:3;service-policy-in=p1, " then
the switch ignores the "map-ip-dscp" profile.
When authentication is successful, the dynamic QoS information may not be
passed from the RADIUS server due to one of the following conditions
(authentication result remains unchanged):
The Filter-ID attribute cannot be found to carry the user profile.
■
The Filter-ID attribute is empty.
■
The Filter-ID attribute format for dynamic QoS assignment is
■
unrecognizable (can not recognize the whole Filter-ID attribute).
Dynamic QoS assignment fails and the authentication result changes from
success to failure when the following conditions occur:
Illegal characters found in a profile value (for example, a non-digital
■
character in an 802.1p profile value).
Failure to configure the received profiles on the authenticated port.
■
When the last user logs off on a port with a dynamic QoS assignment, the
switch restores the original QoS configuration for the port.
When a user attempts to log into the network with a returned dynamic QoS
profile that is different from users already logged on to the same port, the user
is denied access.
While a port has an assigned dynamic QoS profile, any manual QoS
configuration changes only take effect after all users have logged off the port.
Aging Status – Enables aging for authenticated MAC addresses stored in the
secure MAC address table. (Default: Disabled)
This parameter applies to authenticated MAC addresses configured by the MAC
Address Authentication process described in this section, as well as to any
secure MAC addresses authenticated by 802.1X, regardless of the 802.1X
Operation Mode (Single-Host, Multi-Host, or MAC-Based authentication as
described on page 356).
– 301 –
Chapter 12
Network Access (MAC Address Authentication)
| Security Measures