Tunnel Attributes - Cisco SD2008T-NA Configuration Manual

4400 series wireless lan controller
Hide thumbs Also See for SD2008T-NA:
Table of Contents

Advertisement

Configuring Identity Networking

Tunnel Attributes

When any of the other RADIUS attributes (QoS-Level, ACL-Name, Interface-Name, or VLAN-Tag) are
Note
returned, the Tunnel Attributes must also be returned.
Reference RFC2868 defines RADIUS tunnel attributes used for authentication and authorization, and
RFC2867 defines tunnel attributes used for accounting. Where the IEEE 802.1X Authenticator supports
tunneling, a compulsory tunnel may be set up for the Supplicant as a result of the authentication.
In particular, it may be desirable to allow a port to be placed into a particular Virtual LAN (VLAN),
defined in IEEE8021Q, based on the result of the authentication. This can be used, for example, to allow
a wireless host to remain on the same VLAN as it moves within a campus network.
The RADIUS server typically indicates the desired VLAN by including tunnel attributes within the
Access-Accept. However, the IEEE 802.1X Authenticator may also provide a hint as to the VLAN to be
assigned to the Supplicant by including Tunnel attributes within the Access- Request.
For use in VLAN assignment, the following tunnel attributes are used:
Note that the VLANID is 12-bits, taking a value between 1 and 4094, inclusive. Since the
Tunnel-Private-Group-ID is of type String as defined in RFC2868, for use with IEEE 802.1X, the
VLANID integer value is encoded as a string.
When Tunnel attributes are sent, it is necessary to fill in the Tag field. As noted in RFC2868, section 3.1:
Cisco Wireless LAN Controller Configuration Guide
5-24
Tag – The Tag field is one octet in length and is intended to provide a means of grouping attributes
in the same packet which refer to the same tunnel. If the value of the Tag field is greater than 0x00
and less than or equal to 0x1F, it should be interpreted as indicating which tunnel (of several
alternatives) this attribute pertains. If the Tag field is greater than 0x1F, it should be interpreted as
the first byte of the following String field.
String – This field must be present. The group is represented by the String field. There is no
restriction on the format of group IDs.
Tunnel-Type=VLAN (13)
Tunnel-Medium-Type=802
Tunnel-Private-Group-ID=VLANID
The Tag field is one octet in length and is intended to provide a means of grouping attributes in the
same packet which refer to the same tunnel. Valid values for this field are 0x01 through 0x1F,
inclusive. If the Tag field is unused, it must be zero (0x00).
For use with Tunnel-Client-Endpoint, Tunnel-Server-Endpoint, Tunnel-Private-Group-ID,
Tunnel-Assignment-ID, Tunnel-Client-Auth-ID or Tunnel-Server-Auth-ID attributes (but not
Tunnel-Type, Tunnel-Medium-Type, Tunnel-Password, or Tunnel-Preference), a tag field of greater
than 0x1F is interpreted as the first octet of the following field.
Unless alternative tunnel types are provided, (e.g. for IEEE 802.1X Authenticators that may support
tunneling but not VLANs), it is only necessary for tunnel attributes to specify a single tunnel. As a
result, where it is only desired to specify the VLANID, the tag field should be set to zero (0x00) in
all tunnel attributes. Where alternative tunnel types are to be provided, tag values between 0x01 and
0x1F should be chosen.
Chapter 5
Configuring Security Solutions
OL-9141-03

Hide quick links:

Advertisement

Table of Contents
loading

This manual is also suitable for:

Sfe2000p440244042000 series2100 series

Table of Contents