3Com Switch 7754, Configuration Manual

Page: 522 / 940

522 C
HAPTER
49: AAA & RADIUS & HWTACACS C
ONFIGURATION
authentication and authorization configuration for a domain: if the scheme
radius-scheme or scheme local command is executed, the authorization
none command is executed, while the authentication command is not
executed, the authorization information returned from the RADIUS or local
scheme still takes effect.
Configuring Dynamic
VLAN Assignment
The dynamic VLAN assignment feature enables a switch to dynamically add the
switch ports of successfully authenticated users to different VLANs according to
the attributes assigned by the RADIUS server, so as to control the network
resources that different users can access.
Currently, the switch supports the RADIUS authentication server to assign the
following two types of VLAN IDs: integer and string.
■
Integer: If the RADIUS server assigns integer type of VLAN IDs, you can set the
VLAN assignment mode to integer on the switch (this is also the default mode
on the switch). Then, upon receiving an integer ID assigned by the RADIUS
authentication server, the switch adds the port to the VLAN whose VLAN ID is
equal to the assigned integer ID. If no such a VLAN exists, the switch first
creates a VLAN with the assigned ID, and then adds the port to the newly
created VLAN.
■
String: If the RADIUS server assigns string type of VLAN IDs, you can set the
VLAN assignment mode to string on the switch. Then, upon receiving a string
ID assigned by the RADIUS authentication server, the switch compares the ID
with existing VLAN names on the switch. If it finds a match, it adds the port to
the corresponding VLAN. Otherwise, the VLAN assignment fails and the user
cannot pass the authentication.
The switch supports the integer mode and string mode of dynamic VLAN
assignments to adapt to authentication server. Different servers assign VLANs in
different ways. You are recommended to configure the switch based on the mode
of dynamic VLAN assignment used by the server.
In actual applications, to use this feature together with Guest VLAN, you should
better set port control to port-based mode.
Table 403 Common VLAN assignment modes for RADIUS server
Server type Dynamic VLAN assignment mode
CAMS Integer (For the latest version, whether the mode is
integer or string depends on attribute value.)
ACS String
FreeRADIUS Determined by attribute value (A value of 100
represents the integer mode and a value of “100”
represents the string mode).
Shiva Access Manager String
Steel-Belted Radius Administrator String
Table 404 Configure dynamic VLAN assignment
Operation Command Description
Enter system view system-view -