Configuring Dynamic Vlan Assignment For 802.1X Ports - Dell PowerConnect B-RX Configuration Manual

33
Configuring 802.1x port security
•
•
•
•

Configuring dynamic VLAN assignment for 802.1x ports

Brocade's 802.1x implementation supports assigning a port to a VLAN dynamically, based on
information received from an Authentication (RADIUS) Server. If one of the attributes in the
Access-Accept message sent by the RADIUS server specifies a VLAN identifier, and this VLAN
matches a VLAN on the BigIron RX device, the client's port is moved from its default VLAN to the
specified VLAN. When the client disconnects from the network, the port is placed back in its default
VLAN.
When a client/supplicant successfully completes the EAP authentication process, the
Authentication Server (the RADIUS server) sends the Authenticator (the BigIron RX) a RADIUS
Access-Accept message that grants the client access to the network. The RADIUS Access-Accept
message contains attributes set for the user in the user's access profile on the RADIUS server.
If one of the attributes in the Access-Accept message specifies a VLAN identifier, and this VLAN is
available on the BigIron RX, the client's port is moved from its default VLAN to the specified VLAN.
When the client disconnects from the network, the port is placed back in its default VLAN.
NOTE
This feature is supported on port-based VLANs only. This feature cannot be used to place an
802.1x-enabled port into a Layer 3 protocol VLAN.
To enable 802.1x VLAN ID support on the BigIron RX, you must add the following attributes to a
user's profile on the RADIUS server.
TABLE 159
Attribute name
Tunnel-Type
Tunnel-Medium-Type
Tunnel-Private-Group-ID
The device reads the attributes as follows:
•
•
•
972
Tunnel-Type (64) – RFC 2868
Tunnel-Medium-Type (65) – RFC 2868
EAP Message (79) – RFC 2579
Tunnel-Private-Group-Id (81) – RFC 2868
802.1x VLAN attributes required from the RADIUS server
Type
064
065
081
If the Tunnel-Type or the Tunnel-Medium-Type attributes in the Access-Accept message do not
have the values specified above, the BigIron RX ignores the three Attribute-Value pairs. The
client becomes authorized, but the client's port is not dynamically placed in a VLAN.
If the Tunnel-Type or the Tunnel-Medium-Type attributes in the Access-Accept message do have
the values specified above, but there is no value specified for the Tunnel-Private-Group-ID
attribute, the client will not become authorized.
When the BigIron RX receives the value specified for the Tunnel-Private-Group-ID attribute, it
checks whether the <vlan-name> string matches the name of a VLAN configured on the
device. If there is a VLAN on the device whose name matches the <vlan-name>, then the
client's port is placed in the VLAN whose ID corresponds to the VLAN name.
Value
13 (decimal) – VLAN
6 (decimal) – 802
<vlan-name> (string) – either the name or the number of a VLAN
configured on the BigIron RX.
BigIron RX Series Configuration Guide
53-1002253-01