Dell PowerConnect J-EX8208, Software Manual

Page: 2413 / 3660

Configuring Match Statements on the RADIUS Server
You can configure simple filter conditions using the
Juniper-Switching-Filter
attribute in
the Juniper dictionary on the RADIUS server. These filters are then sent to a switch
whenever a new user is authenticated successfully. The filters are created and applied
on all J-EX Series switches that authenticate users through that RADIUS server without
the need to configure anything on each individual switch.
To configure the Juniper-Switching-Filter attribute, enter one or more match conditions
and a resulting action using the CLI for the RADIUS server. Enter the match statement
plus an action statement enclosed within quotes (" ") using the following syntax:
match < destination-mac mac-address> < source-vlan vlan-name> < source-dot1q-tag
tag> < destination-ip ip-address> < ip-protocol protocol-id> < source-port port>
< destination-port port>
}
action [ allow | deny ] < forwarding-class class-of-service> < loss-priority (low | medium |
high)>
}
See “VSA Match Conditions and Actions for J-EX Series Switches” on page 2348 for
definitions of match statement options.
To configure match conditions on the RADIUS server:
1.
Verify that the Juniper dictionary is loaded on your RADIUS server and includes the
filtering attribute
Juniper-Switching-Filter
, attribute ID 48:
[root@freeradius]#
cat /usr/local/share/freeradius/dictionary.juniper
# dictionary.juniper
#
# Version: $Id: dictionary.juniper,v 1.2.6.1 2005/11/30 22:17:25
aland Exp
$
# VENDOR Juniper 2636
BEGIN-VENDOR Juniper
ATTRIBUTE Juniper-Local-User-Name 1 string
ATTRIBUTE Juniper-Allow-Commands 2 string
ATTRIBUTE Juniper-Deny-Commands 3 string
ATTRIBUTE Juniper-Allow-Configuration 4 string
ATTRIBUTE Juniper-Deny-Configuration 5 string
ATTRIBUTE Juniper-Switching-Filter 48 string
<—
2.
Enter the match conditions and actions. For example:
•
To deny authentication based on the 802.1Q tag (here, the 802.1Q tag is
10
):
[root@freeradius]#
cd /usr/local/etc/raddb
vi users
For each relevant user, add the
Juniper-Switching-Filter
attribute:
Juniper-Switching-Filter = "match source-dot1q-tag 10 action deny"
2341
Chapter 83: Configuring Access Control