Interlogix NS3552-8P-2S-V2, User Manual

Page: 222 / 511

Chapter 4: Web configuration
220 NS3552-8P-2S-V2 User Manual
Object Description
anyone. Also, only the MD5-Challenge method is supported. The maximum
number of clients that can be attached to a port can be limited using the port
security limit control functionality.
RADIUS-Assigned
QoS Enabled
When RADIUS-Assigned QoS is both globally enabled and enabled
(selected) for a given port, the switch reacts to QoS Class information
carried in the RADIUS access-accept packet transmitted by the RADIUS
server when a supplicant is successfully authenticated. If present and valid,
traffic received on the supplicant's port will be classified to the given QoS
Class. If (re-)authentication fails or the RADIUS access-accept packet no
longer carries a QoS Class, it is invalid, or the supplicant is otherwise no
longer present on the port, the port's QoS Class immediately reverts to the
original QoS Class (which may be changed by the administrator in the
meantime without affecting the RADIUS-assigned).
This option is only available for single-client modes (i.e., Port-based 802.1X
and Single 802.1X).
RADIUS attributes used in identifying a QoS Class:
The User-Priority-Table attribute defined in RFC4675 forms the basis for
identifying the QoS Class in an access-accept packet.
Only the first occurrence of the attribute in the packet will be considered and,
to be valid, it must follow this rule:
All eight octets in the attribute's value must be identical and consist of ASCII
characters in the range '0' - '3', which translates into the required QoS Class
in the range [0; 3].
RADIUS-Assigned
VLAN Enabled
When RADIUS-Assigned VLAN is both globally enabled and enabled
(selected) for a given port, the switch reacts to VLAN ID information carried
in the RADIUS Access-Accept packet transmitted by the RADIUS server
when a supplicant is successfully authenticated. If present and valid, the
port's Port VLAN ID will be changed to this VLAN ID, the port will be set to
be a member of that VLAN ID, and the port will be forced into VLAN unaware
mode. Once assigned, all traffic arriving on the port will be classified and
switched on the RADIUS-assigned VLAN ID.
If (re-)authentication fails or the RADIUS Access-Accept packet no longer
carries a VLAN ID or it's invalid, or the supplicant is otherwise no longer
present on the port, the port's VLAN ID immediately reverts to the original
VLAN ID (which may be changed by the administrator in the meanwhile
without affecting the RADIUS-assigned).
This option is only available for single-client modes (i.e., Port-based 802.1X
and Single 802.1X).
For troubleshooting VLAN assignments, use the "Monitor > VLANs > VLAN
Membership and VLAN Port" pages. These pages show which modules
have (temporarily) overridden the current Port VLAN configuration.
RADIUS attributes used in identifying a VLAN ID:
RFC2868 and RFC3580 form the basis for the attributes used in identifying a
VLAN ID in an Access-Accept packet. The following criteria are used:
The Tunnel-Medium-Type, Tunnel-Type, and Tunnel-Private-Group-ID
attributes must all be present at least once in the Access-Accept packet.
The switch looks for the first set of these attributes that have the same Tag
value and fulfill the following requirements (if Tag == 0 is used, the Tunnel-
Private-Group-ID does not need to include a Tag):
Value of Tunnel-Medium-Type must be set to "IEEE-802" (ordinal 6).
Value of Tunnel-Type must be set to "VLAN" (ordinal 13).
Value of Tunnel-Private-Group-ID must be a string of ASCII chars in the