Extreme Networks ExtremeWare XOS 11.3, Manual

Page: 351 / 698

Authenticating Users
ExtremeWare XOS 11.3 Concepts Guide
351
Exclusions and Limitations
The following are limitations and exclusions for network login:
●
All unauthenticated MACs will be seeing broadcasts and multicasts sent to the port if even a single
MAC is authenticated on that port.
●
Network login must be disabled on a port before that port can be deleted from a VLAN.
●
In Campus mode on the BlackDiamond 8800 family of switches and the Summit X450 switch, with
untagged VLANs and the netlogin port’s mode configured as port-mode, after the port moves to the
destination VLAN, the original VLAN for that port is not displayed.
●
A network login VLAN port should not be a part of following protocols:
■
Ethernet Automatic Protection Switching (EAPS)
■
Extreme Standby Router Protocol (ESRP)
■
Spanning Tree Protocol (STP)
■
Link Aggregation
Authenticating Users
Network login uses two methods to authenticate users trying to access the network:
●
RADIUS servers
●
Local database
All three network login protocols, web-based, MAC-based, and 802.1x netlogin, support RADIUS
authentication. Only web-based and MAC-based netlogin support local database authentication.
This section describes the following topics in greater detail:
●
Creating User Accounts on the RADIUS Server on page 351
●
Configuring Local Database Authentication on page 355
Creating User Accounts on the RADIUS Server
You can create two types of user accounts on your RADIUS server for authenticating network login
users: netlogin-only enabled and netlogin-only disabled. A netlogin-only disabled user can log in using
network login and can also access the switch using Telnet or SSH. A netlogin-only enabled user can
only log in using network login and cannot access the switch using the same login.
NOTE
For information on how to use and configure your RADIUS server, please refer to the documentation that came with
your RADIUS server.
In the following example using FreeRADIUS, you add the configuration to the RADIUS server users
file. The users file determines which attributes are sent back by the RADIUS server to the RADIUS
client (an Extreme Networks switch). Depending on your RADIUS server, where and how you add the
configuration might be different.