manualshive.com logo in svg

Avaya ERS 2400, Technical Configuration Manual

Share
Download
Avaya ERS 2400 Technical Configuration Manual Download Page 44

 

Avaya Inc. 

– Proprietary & Confidential. 

Use pursuant to the terms of your signed agreement or Avaya policy.

 

43 

avaya.com 

IDE  Step  9 

–  Go  to 

Site  Configuration  ->  Access  Policies  ->  MAC  Auth  ->  default-radius-

device 

and via the 

Authorization Policy

 tab, select 

Philips

 and click on 

Edit

 

 

IDE Step 10 

– Move the attribute we configured above named 

UROLphilips

 from 

All Outbound 

Value

 box to the 

Provision With

 box and click 

OK

.   

 

 

 

 

Summary of Contents for ERS 2400

Page 1: ...s Ignition Server Technical Configuration Guide Enterprise Solutions Engineering Document Date April 2010 Document Number NN48500 586 Document Version 2 0 Identify Engines Ignition Server Ethernet Rou...

Page 2: ...are Ethernet attached The main components include both the Ethernet edge switches and the Network Access Control infrastructure provided by Avaya s Identity Engines portfolio The audience for this Tec...

Page 3: ...nts Conventions 3 1 Overview Medical Device Authentication using Identify Engines 4 1 1 Access Layer 4 1 2 Ignition Server Biomedical Device Authentication 4 1 3 Configuration Examples 5 1 4 Biomedica...

Page 4: ...hts important information about an action that may result in equipment damage configuration or data loss Text Bold text indicates emphasis Italic text in a Courier New font indicates text the user mus...

Page 5: ...Ignition Server to authenticate biomedical devices from an EAP authenticator it must know the device identity typically the MAC address In an existing network consisting of many biomedical devices mos...

Page 6: ...s and Siemens for this example The Ethernet Routing Switch 5500 can be configured to accept both EAP and non EAP NEAP on the same port In regards to non EAP the switch can be configured to accept a pa...

Page 7: ...g vlan create 1600 name siemens type port 5520 24T 1 config vlan create 3000 name general type port ERS5520 1 Step 2 Enable VLAN tagging on all appropriate ports 5520 24T 1 config vlan port 23 24 tagg...

Page 8: ...s on port uplink ports ERS5520 1 Step 1 Enable Discard Untagged Frames 5520 1 config vlan ports 23 24 filter untagged frame enable 1 4 1 6 Enable Spanning Tree Fast Start and BPDU Filtering on access...

Page 9: ...n enable RADIUS accounting using the command radius accounting enable 1 4 1 9 Enable EAP globally ERS5520 1 Step 1 Enable non EAP NEAP 5520 24T 1 config eap multihost allow non eap enable ERS5520 1 St...

Page 10: ...and enable RADIUS NEAP phone 5520 24T 1 config interface fastEthernet 14 20 5520 24T 1 config if eapol status auto 5520 24T 1 config if eapol multihost allow non eap enable 5520 24T 1 config if eapol...

Page 11: ...rt 14 Admin Status Auto Auth No Admin Dir Both Oper Dir Both ReAuth Enable No ReAuth Period 3600 Quiet Period 60 Xmit Period 30 Supplic Timeout 30 Server Timeout 30 Max Req 2 RDS DSE No Port 20 Admin...

Page 12: ...Enabled Non EAPOL RADIUS Password Attribute Format MACAddr Non EAPOL User Based Policies Enabled Non EAPOL User Based Policies Filter On MAC Addresses Disabled Use most recent RADIUS VLAN Disabled St...

Page 13: ...OL RADIUS VLANs is Enabled globally and at interface level 1 4 2 3 Verify EAP Multihost Status Step 1 Assuming Siemens devices on ports 14 15 and Philips devices on ports19 20 verify device MAC addres...

Page 14: ...IVL No Port Members 14 15 23 24 3000 general Port None 0x0000 Yes IVL No Port Members 14 20 23 24 Total VLANs 5 On ERS5520 1 verify the following information Option Verify Port Display the ports where...

Page 15: ...3 IDE Setup 1 4 3 1 Create a new Nortel device template IDE Step 1 Go to Site Configuration Provisioning Vendor VSA s Nortel Device Template New IDE Step 2 Name the new Nortel device template Nortel V...

Page 16: ...complete configuration Please note that you must change the Avaya switch device template MAC Address Source from the default setting of Inbound Calling Station Id to Inbound User Name for device authe...

Page 17: ...re an Outbound Attribute on Ignition Server for VLAN IDE Step 1 Go to Site Configuration Provisioning Outbound Attributes New IDE Step 2 Via the Outbound Attribute window enter a name for the attribut...

Page 18: ...ya com IDE Step 3 Go to Site Configuration Provisioning Outbound Values New IDE Step 4 Using the Outbound Attribute created in Step 2 we will add the VLAN ID value for the Philips VLAN Start by enteri...

Page 19: ...created in Step 2 i e VLAN as used in this example via the Choose Global Outbound Attribute pull down menu Make sure the Fixed Value radio button is selected Enter an name i e Philips VLAN 1500 as us...

Page 20: ...p 3 to 5 to add the RADIUS attribute for the Siemens VLAN Go to Site Configuration Provisioning Outbound Values New IDE Step 7 Using the Outbound Attribute created in Step 2 we will add the VLAN ID va...

Page 21: ...he correct VLAN number i e 1600 as used in this example in the VLAN ID window Click on OK twice when done 1 4 3 3 Add Access Policy The following is a list of top biomedical manufacturers vendor MAC s...

Page 22: ...vaya policy 21 avaya com IDE Step 1 Go to Site Configuration Access Policies MAC Auth default radius device and click on Edit IDE Step 2 First we will create a rule for the Philips medical devices Sta...

Page 23: ...the Constraint Details window under Attribute Category select Device and then scroll down and select device address Next via the right hand side plane select Starts With make sure Static Value is sel...

Page 24: ...hentication Policy window click the Allow radio button via Action Provisioning and move the attribute we configured above named vlan 1500 philips from All Outbound Value box to the Provision With box...

Page 25: ...the Constraint Details window under Attribute Category select Device and then scroll down and select device address Next via the right hand side plane select Starts With make sure Static Value is sel...

Page 26: ...cation Policy window click the Allow radio button via Action Provisioning and move the attribute we configured above named vlan 1600 Siemens from All Outbound Value box to the Provision With box IDE S...

Page 27: ...Avaya Inc Proprietary Confidential Use pursuant to the terms of your signed agreement or Avaya policy 26 avaya com...

Page 28: ...s For Ignition Server to process the Avaya switch RADIUS requests each switch must be added as an Authenticator IDE Step 1 Go to Site Configuration Authenticators default For example we will create ne...

Page 29: ...select the template we created in the section above titled Create a new Nortel device template Nortel VLAN as used in our example Make sure Enable MAC Auth is checked off and Do Not Use Password is s...

Page 30: ...Avaya Inc Proprietary Confidential Use pursuant to the terms of your signed agreement or Avaya policy 29 avaya com...

Page 31: ...nal Devices Next we will add the vendor MAC prefix via the Internal Store on Ignition Server IDE Step 1 Go to Site Configuration Directories Internal Store Internal Devices First we will add the MAC p...

Page 32: ...greement or Avaya policy 31 avaya com IDE Step 2 Go to Site Configuration Directories Internal Store Internal Devices Next we will add the MAC prefix for Siemens Via the Internal Devices window Click...

Page 33: ...Ignition Server Advanced Troubleshooting feature For example let s assume we wish to test a Philips device which starts with a vendor MAC of 00 09 5c Step 1 Via Ignition Dashboard select the IP addre...

Page 34: ...the following information Option Verify Results First of all if successful Device lookup successful should be displayed Virtual Attributes Verify the following pertaining to the configuration used in...

Page 35: ...witch and various details pertaining to the device such as RADIUS attributes and device details Knowing this information you could keep a database of all medical device identifiers and the switch and...

Page 36: ...Avaya Inc Proprietary Confidential Use pursuant to the terms of your signed agreement or Avaya policy 35 avaya com Result...

Page 37: ...Allow should be displayed If not verify the device using the previous step and if this also fails verify the Ignition Server configuration User Id This field displays the full MAC address of the devi...

Page 38: ...ype Specify the ethertype classifier criteria eval order Specify the evaluation order flow id Specify the IPv6 flow identifier classifier criteria next header Specify the IPv6 next header classifier c...

Page 39: ...T 1 config qos agent ubp high security local The default ubp classifier action non match action is for forward traffic In older software releases for the ERS5500 this was not the case and you had to e...

Page 40: ...lips and UROLsiemens as per the policies configured on ERS5520 1 On Ignition Server the Nortel vendor VSA definitions are already defined and can be viewed by using Ignition Dashboard and going to Sit...

Page 41: ...ement or Avaya policy 40 avaya com IDE Step 3 Go to Site Configuration Provisioning Outbound Values and click on New IDE Step 4 When the Outbound Value Details window pops up enter a name i e UROLphil...

Page 42: ...bal Outbound Attribute and select the outbound attribute name from step 2 above Select Value of String and enter string name of UROLphilips for the UBP name of philips configured for the Philips devic...

Page 43: ...ens as used in this example via the Outbound Value Name window and click on New IDE Step 8 When the Outbound Value instance window pops up under Choose Global Outbound Attribute and select the outboun...

Page 44: ...43 avaya com IDE Step 9 Go to Site Configuration Access Policies MAC Auth default radius device and via the Authorization Policy tab select Philips and click on Edit IDE Step 10 Move the attribute we...

Page 45: ...44 avaya com IDE Step 11 Go to Site Configuration Access Policies MAC Auth default radius device and via the Authorization Policy tab select Siemens and click on Edit IDE Step 12 Move the attribute we...

Page 46: ...signed agreement or Avaya policy 45 avaya com IDE Step 13 Once complete we can go to Site Configuration Access Policy MAC Auth default radius device and clicking on Access Policy Summary to view the...

Page 47: ...ore Destination L4 Port Max Ignore Source L4 Port Min Ignore Source L4 Port Max Ignore IPv6 Flow Id Ignore IP Flags Ignore TCP Control Flags Ignore IPv4 Options Ignore Destination MAC Addr Ignore Dest...

Page 48: ...p No Action Update DSCP 0x10 Action Update 802 1p Priority Ignore Action Set Drop Precedence Low Drop Storage Type NonVolatile On the ERS5520 verify the following information Option Verify Name Verify...

Page 49: ...owing command to view the UBP Policy 5520 24T 1 show qos ubp interface Result Id Unit Port Filter Set Name _____ ____ ____ _______________ 55001 1 14 siemens 55004 1 19 philips On the ERS5520 verify t...

Page 50: ...to connect to ERS5520 1 is port 3 29 ERS8600 5 5 config ip ipfix state enable ERS8600 5 5 config ip ipfix port 3 29 all traffic enable ERS8600 6 5 show ip ipfix flows 3 IPFIX Flows Slot Number 3 Total...

Page 51: ...ary Confidential Use pursuant to the terms of your signed agreement or Avaya policy 50 avaya com 2 Software Baseline Product Minimum Software Level Identity Engines 6 0 1 ERS2500 4 2 ERS4500 5 3 ERS55...

Page 52: ...ollection ERS4500_5 3_Doc_Collection_20090731 Ethernet Routing Switch 4500 Software Release 5 3 Avaya Ethernet Routing Switch 5500 Series Release 5 1 Document Collection ERS5500_6 1_Doc_Collection_200...

Reviews:

No comments

Brands by name

Popular brands

Load more brands