802.1X Authentication And Vlans; Authenticated And Unauthenticated Vlans - Dell PowerConnect M6220 Configuration Manual

Maximum Requests............................... 2
Max Users...................................... 3
Supplicant Timeout............................. 30
Server Timeout (secs).......................... 30
Logical Supplicant
Port MAC-Address
------- --------------
112 0000.0000.0000

802.1X Authentication and VLANs

The PowerConnect 6200 Series switches allow a port to be placed into a particular VLAN based on the
result of type of 802.1X authentication a client uses when it accesses the switch. The RADIUS server or
IEEE 802.1X Authenticator can provide information to the switch about which VLAN to assign the host
(supplicant).
When a host connects to a switch that uses a RADIUS server or 802.1X Authenticator to authenticate
the host, the host authentication can typically have one of three outcomes:
• The host is authenticated.
• The host attempts to authenticate but fail because it lacks certain security credentials.
• The host is a guest and does not try to authenticate at all.
You can create three separate VLANs on the switch to handle hosts depending on whether the host
authenticates, fails the authentication, or is a guest. The RADIUS server informs the switch of the
selected VLAN as part of the authentication.

Authenticated and Unauthenticated VLANs

Hosts that authenticate normally use a VLAN that includes access to network resources. Hosts that fail
the authentication might be denied access to the network or placed on a "quarantine" VLAN with
limited network access.
Much of the configuration to assign hosts to a particular VLAN takes place on the RADIUS server or
802.1X authenticator. If you use an external RADIUS server to manage VLANs, you configure the server
to use Tunnel attributes in Access-Accept messages in order to inform the switch about the selected
VLAN. These attributes are defined in RFC 2868, and their use for dynamic VLAN is specified in RFC
3580.
The VLAN attributes defined in RFC3580 are as follows:
• Tunnel-Type=VLAN (13)
• Tunnel-Medium-Type=802
• Tunnel-Private-Group-ID=VLANID
88
Device Security
AuthPAE Backend
State State
-------- --------
Initialize Idle
VLAN Username Filter
Id Id
----- -------- ------