Extreme Networks ExtremeWare XOS 11.3, Manual

Page: 365 / 698

Web-Based Authentication
ExtremeWare XOS 11.3 Concepts Guide
365
Configuring Session Refresh
To enable or disable the network login session refresh, use one of the following commands:
enable netlogin session-refresh {<minutes>}
disable netlogin session-refresh
Where
<minutes>
ranges from 1 - 255. The default setting is 3 minutes.
enable netlogin session-
refresh
makes the logout window refresh itself at every configured time interval.
Session -refresh
is disabled by default. When you configure the network login session refresh for the logout window,
ensure that the FDB aging timer is greater than the network login session refresh timer.
Configuring Logout Privilege
To enable or disable network login logout privilege, use one of the following commands:
enable netlogin logout-privilege
disable netlogin logout-privilege
These commands turn the privilege for netlogin users to logout by popping up (or not popping up) the
logout window.
Logout-privilege
is enabled by default.
Web-Based Network Login Configuration Example
The following configuration example shows both the Extreme Networks switch configuration and the
Radius server entries needed to support the example. VLAN
corp is assumed to be a corporate subnet
which has connections to DNS, WINS servers, network routers, and so on. VLAN temp is a temporary
VLAN and is created to provide connections to unauthenticated network login clients. Unauthenticated
ports belong to the VLAN
temp . This kind of configuration provides better security as unauthenticated
clients do not connect to the corporate subnet and will not be able to send or receive any data. They
have to get authenticated in order to have access to the network.
●
ISP Mode—Network login clients connected to ports 1:10 - 1:14, VLAN corp , will be logged into the
network in ISP mode. This is controlled by the fact that the VLAN in which they reside in
unauthenticated mode and the RADIUS server Vendor Specific Attributes (VSA),
Extreme-
Netlogin-Vlan
, are the same, corp . So there will be no port movement. Also if this VSA is missing
from RADIUS server, it is assumed to be ISP Mode.
●
Campus Mode—On the other hand, clients connected to ports 4:1 - 4:4, VLAN temp , will be logged
into the network in Campus mode since the port will move to the VLAN corp after getting
authenticated. A port moves back and forth from one VLAN to the other as its authentication state
changes.
Both ISP and Campus mode are not tied to ports but to a user profile. In other words, if the VSA
Extreme:Extreme-Netlogin-Vlan
represents a VLAN different from the one in which the user
currently resides, then VLAN movement will occur after login and after logout. In following example, it
is assumed that campus users are connected to ports 4:1-4:4, while ISP users are logged in through ports
1:10-1:14.
NOTE
In the following sample configuration, any lines marked
( Default )
represent default settings and do not need to
be explicitly configured.