Configuring 802.1X Interface Settings (Cli Procedure) - Juniper JUNOS OS 10.3 - SOFTWARE Manual

Complete Software Guide for Junos
Example: Configuring MAC RADIUS Authentication on an EX Series Switch
Requirements
Overview and Topology
2564
®
OS for EX Series Ethernet Switches, Release 10.3
To permit hosts that are not 802.1X-enabled to access the LAN, you can configure MAC
RADIUS authentication on the switch interfaces to which the non-802.1X-enabled hosts
are connected. When MAC RADIUS authentication is configured, the switch will attempt
to authenticate the host with the RADIUS server using the host's MAC address.
This example describes how to configure MAC RADIUS authentication for two
non-802.1X-enabled hosts:
Requirements on page 2564
Overview and Topology on page 2564
Configuration on page 2566
Verification on page 2567
This example uses the following hardware and software components:
Junos OS Release 9.3 or later for EX Series switches.
An EX Series switch acting as an authenticator port access entity (PAE). The ports on
the authenticator PAE form a control gate that blocks all traffic to and from supplicants
until they are authenticated.
A RADIUS authentication server. The authentication server acts as the backend
database and contains credential information for hosts (supplicants) that have
permission to connect to the network.
Before you configure MAC RADIUS authentication, be sure you have:
Configured basic access between the EX Series switch and the RADIUS server. See
"Example: Connecting a RADIUS Server for 802.1X to an EX Series Switch" on page 2545.
Performed basic bridging and VLAN configuration on the switch. See "Example: Setting
Up Basic Bridging and a VLAN for an EX Series Switch" on page 1305.
Performed basic 802.1X configuration. See "Configuring 802.1X Interface Settings (CLI
Procedure)" on page 2609.
IEEE 802.1X Port-Based Network Access Control (PNAC) authenticates and permits
devices access to a LAN if the devices can communicate with the switch using the 802.1X
protocol (are 802.1X-enabled). To permit non-802.1X-enabled end devices to access
the LAN, you can configure MAC RADIUS authentication on the interfaces to which the
end devices are connected. When the MAC address of the end device appears on the
interface, the switch consults the RADIUS server to check whether it is a permitted MAC
address. If the MAC address of the end device is configured as permitted on the RADIUS
server, the switch opens LAN access to the end device.
Copyright © 2010, Juniper Networks, Inc.