Is Unavailable To An Ex Series Switch - Juniper JUNOS OS 10.3 - SOFTWARE Manual

Complete Software Guide for Junos
Example: Configuring 802.1X Authentication Options When the RADIUS Server is
Unavailable to an EX Series Switch
Requirements
Overview and Topology
2550
®
OS for EX Series Ethernet Switches, Release 10.3
Server fail fallback allows you to specify how 802.1X supplicants connected to the switch
are supported if the RADIUS authentication server becomes unavailable or sends an EAP
Access-Reject message.
You use 802.1X to control network access. Only users and devices (supplicants) providing
credentials that have been verified against a user database are allowed access to the
network. You use a RADIUS server as the user database.
This example describes how to configure an interface to move a supplicant to a VLAN
in the event of a RADIUS server timeout:
Requirements on page 2550
Overview and Topology on page 2550
Configuration on page 2552
Verification on page 2553
This example uses the following hardware and software components:
Junos OS Release 9.3 or later for EX Series switches
One EX Series switch acting as an authenticator port access entity (PAE). The ports
on the authenticator PAE form a control gate that blocks all traffic to and from
supplicants until they are authenticated.
One RADIUS authentication server that supports 802.1X. The authentication server
acts as the backend database and contains credential information for hosts
(supplicants) that have permission to connect to the network.
Before you connect the server to the switch, be sure you have:
Performed basic bridging and VLAN configuration on the switch. See "Example: Setting
Up Basic Bridging and a VLAN for an EX Series Switch" on page 1305.
Set up a connection between the switch and the RADIUS server. See "Example:
Connecting a RADIUS Server for 802.1X to an EX Series Switch" on page 2545.
Disable firewall filters on the interface. Firewall filters interfere with server fail fallback
operation.
Configured users on the authentication server.
A RADIUS server timeout occurs if no authentication RADIUS servers are reachable when
a supplicant logs in and attempts to access the LAN. Using server fail fallback, configure
alternative options for supplicants attempting LAN access. You can configure the switch
to accept or deny access to supplicants or to maintain the access already granted towards
Copyright © 2010, Juniper Networks, Inc.