Juniper JUNOS OS 10.3 - SOFTWARE, Manual

Page: 2646 / 3946

Example: Configuring 802.1X Authentication Options When the RADIUS Server is
Unavailable to an EX Series Switch
Server fail fallback allows you to specify how 802.1X supplicants connected to the switch
are supported if the RADIUS authentication server becomes unavailable or sends an EAP
Access-Reject message.
You use 802.1X to control network access. Only users and devices (supplicants) providing
credentials that have been verified against a user database are allowed access to the
network. You use a RADIUS server as the user database.
This example describes how to configure an interface to move a supplicant to a VLAN
in the event of a RADIUS server timeout:
• Requirements on page 2550
•
Overview and Topology on page 2550
•
Configuration on page 2552
• Verification on page 2553
Requirements
This example uses the following hardware and software components:
• Junos OS Release 9.3 or later for EX Series switches
• One EX Series switch acting as an authenticator port access entity (PAE). The ports
on the authenticator PAE form a control gate that blocks all traffic to and from
supplicants until they are authenticated.
• One RADIUS authentication server that supports 802.1X. The authentication server
acts as the backend database and contains credential information for hosts
(supplicants) that have permission to connect to the network.
Before you connect the server to the switch, be sure you have:
•
Performed basic bridging and VLAN configuration on the switch. See “Example: Setting
Up Basic Bridging and a VLAN for an EX Series Switch” on page 1305.
• Set up a connection between the switch and the RADIUS server. See “Example:
Connecting a RADIUS Server for 802.1X to an EX Series Switch” on page 2545.
•
Disable firewall filters on the interface. Firewall filters interfere with server fail fallback
operation.
• Configured users on the authentication server.
Overview and Topology
A RADIUS server timeout occurs if no authentication RADIUS servers are reachable when
a supplicant logs in and attempts to access the LAN. Using server fail fallback, configure
alternative options for supplicants attempting LAN access. You can configure the switch
to accept or deny access to supplicants or to maintain the access already granted towards
Copyright © 2010, Juniper Networks, Inc. 2550
Complete Software Guide for Junos
®
OS for EX Series Ethernet Switches, Release 10.3