Dell PowerConnect B-FCXs Configuration Manual page 1273

NOTE
When a show run command is issued during a session, the dynamically-assigned VLAN is not
displayed.
Enable 802.1X VLAN ID support by adding the following attributes to a user profile on the RADIUS
server.
Attribute name
Tunnel-Type
Tunnel-Medium-Type
Tunnel-Private-Group-ID
The device reads the attributes as follows:
•
•
•
•
•
The show interface command displays the VLAN to which an 802.1X-enabled port has been
dynamically assigned, as well as the port from which it was moved (that is, the port default
VLAN).Refer to
output indicating the port dynamically assigned VLAN.
Dynamic multiple VLAN assignment for 802.1X ports
When you add attributes to a user profile on the RADIUS server, the <vlan-name> value for the
Tunnel-Private-Group-ID attribute can specify the name or number of one or more VLANs configured
on the Dell PowerConnect device.
For example, to specify one VLAN, configure the following for the <vlan-name> value in the
Tunnel-Private-Group-ID attribute on the RADIUS server.
In this example, the port on which the Client is authenticated is assigned to VLAN 10 or the VLAN
named "marketing". The VLAN to which the port is assigned must have previously been configured
on the Dell PowerConnect device.
PowerConnect B-Series FCX Configuration Guide
53-1002266-01
Type
064
065
081
If the Tunnel-Type or the Tunnel-Medium-Type attributes in the Access-Accept message do not
have the values specified above, the Dell PowerConnect device ignores the three
Attribute-Value pairs. The client becomes authorized, but the client port is not dynamically
placed in a VLAN.
If the Tunnel-Type or the Tunnel-Medium-Type attributes in the Access-Accept message do have
the values specified above, but there is no value specified for the Tunnel-Private-Group-ID
attribute, the client will not become authorized.
When the Dell PowerConnect device receives the value specified for the
Tunnel-Private-Group-ID attribute, it checks whether the <vlan-name> string matches the
name of a VLAN configured on the device. If there is a VLAN on the device whose name
matches the <vlan-name> string, then the client port is placed in the VLAN whose ID
corresponds to the VLAN name.
If the <vlan-name> string does not match the name of a VLAN, the Dell PowerConnect device
checks whether the string, when converted to a number, matches the ID of a VLAN configured
on the device. If it does, then the client port is placed in the VLAN with that ID.
If the <vlan-name> string does not match either the name or the ID of a VLAN configured on
the device, then the client will not become authorized.
"Displaying dynamically assigned VLAN information"
"10" or "marketing"
Configuring 802.1X port security
Value
13 (decimal) – VLAN
6 (decimal) – 802
<vlan-name> (string) – either the name or the number of a VLAN
configured on the Dell PowerConnect device.
34
on page 1251 for sample
1231