Alcatel-Lucent OmniAccess 700, Cli Configuration Manual

Page: 235 / 1193

802.1X Overview
Except on the first page, right running head:
Heading1 or Heading1NewPage text (automatic)
209
Alcatel-Lucent
Beta Beta
CLI Configuration Guide
U
SING
802.1X
WITH
VLAN A
SSIGNMENT
After successful 802.1X authentication of a port, the RADIUS server sends the
VLAN assignment to configure the switchport. The RADIUS server database
maintains the user name-to-VLAN mappings, which assigns the VLAN based on
the user name of the client connected to the switch port.
When configured on the switch and the RADIUS server, 802.1X with VLAN
assignment has these characteristics:
•
If no VLAN is supplied by the RADIUS server, the port is configured in its access
VLAN after successful authentication.
•
If the VLAN information from the RADIUS server is not valid, the port remains in
the configured access VLAN.
•
Otherwise, if all information from the RADIUS server is valid, the port is placed in
the specified VLAN after authentication.
•
If the multiple-hosts mode is enabled on an 802.1X port, all hosts are placed in the
same VLAN (specified by the RADIUS server) as the first authenticated host.
•
If 802.1X is disabled on the port, it is returned to the configured access VLAN.
•
When the port is in the force authorized, force unauthorized, unauthorized, or
shutdown state, it is placed in the configured access VLAN.
•
If an 802.1X port is authenticated and put in the RADIUS server assigned VLAN,
any change to the port access VLAN configuration does not take effect.
•
If the multi-auth mode is enabled on a 802.1X port, the dynamic VLAN featured is
disabled, i.e., VLAN information received from RADIUS server will not do any
effect on the port.
To configure VLAN assignment, you need to perform these tasks:
•
Enable AAA services.
•
Enable 802.1X (the VLAN assignment feature is automatically enabled when you
configure 802.1X on an access port).
•
Assign vendor-specific tunnel attributes in the RADIUS server. The RADIUS
server must return these attributes to the switch:
• [64] Tunnel-Type = VLAN
• [65] Tunnel-Medium-Type = IEEE-802
• [81] Tunnel-Private-Group-ID = VLAN ID
Attribute [64] must contain the value VLAN (type 13).
Attribute [65] must contain the value 802 (type 6).
Attribute [81] specifies the VLAN name or VLAN ID assigned to the 802.1X-
authenticated user.
A
LCATEL
-L
UCENT
S
PECIFIC
O
VERVIEW
Alcatel-Lucent’s Gigabit Ethernet line card (L2GE Card) is used for layer-2
functionality. 802.1X is a port based authentication protocol, which provides the
access to the port. Before giving any access to the hosts, which are connected to
L2GE Ports, needs to be authenticated on L2GE ports.