Extreme Networks ExtremeWare XOS 11.3, Manual

Page: 361 / 698

802.1x Authentication
ExtremeWare XOS 11.3 Concepts Guide
361
802.1x Network Login Configuration Example
The following configuration example shows the Extreme Networks switch configuration needed to
support the 802.1x network login example.
NOTE
In the following sample configuration, any lines marked
(Default)
represent default settings and do not need to
be explicitly configured.
create vlan “temp”
create vlan “corp”
configure vlan “default” delete ports 4:1-4:4
# Configuration Information for VLAN corp
# No VLAN-ID is associated with VLAN corp.
configure vlan “corp” protocol “ANY” (Default)
configure vlan “corp” ipaddress 10.203.0.224 255.255.255.0
# Configuration Information for VLAN Mgmt
configure vlan “Mgmt” ipaddress 10.10.20.30 255.255.255.0
# Network Login Configuration
configure netlogin vlan “temp”
enable netlogin dot1x
enable netlogin ports 1:10-1:14, 4:1-4:4 dot1x
# RADIUS Configuration
configure radius netlogin primary server 10.0.1.2 1812 client-ip 10.10.20.30 vr “VR-
Mgmt”
configure radius netlogin primary shared-secret purple
enable radius
The following example is for the FreeRADIUS server; the configuration might be different for your
RADIUS server:
#RADIUS Server Setting, in this example the user name is eaptest
eaptest Auth-Type := EAP, User-Password == "eaptest"
Session-Timeout = 120,
Termination-Action =1
NOTE
For information about how to use and configure your RADIUS server, please refer to the documentation that came
with your RADIUS server.
Configuring Guest VLANs
802.1x authentication supports the concept of guest VLANs. A guest VLAN provides limited or
restricted network access if a supplicant does not respond to the 802.1x authentication requests sent by
the switch. You configure a guest VLAN only on netlogin ports with 802.1x enabled; movement to a
guest VLAN is not supported on netlogin ports with MAC-based or web-based authentication. 802.1x
must be the only authentication method enabled on the port for movement to guest VLAN. A port
always moves untagged into the guest VLAN.