30
Using security in your network
address may not have a Radius-assigned VLAN value. At this point, the port
is moved to a configured VLAN. A later authenticated EAP MAC address
(for instance, the third one on the port) can get a Radius-assigned VLAN
value. This port is then added, and the port VLAN ID (PVID) is set to the
first such VLAN value from the Radius server. The VLAN remains the same
irrespective of which MAC leaves, and a change in the VLAN takes place
only when there are no authenticated hosts on the port.
This enhancement works in a very similar manner with the already existing
Radius assigned VLANs feature in SHSA mode. It is basically an extension
of that feature which gives the user the ability to move a port to a specific
VLAN, even if that switch port operates in EAP MHMA mode.
The only restriction of this enhancement is that if you have multiple EAP
clients authenticating on a given switch port (as you normally can in MHMA
mode), each one configured with a different VLAN ID on the Radius server,
the switch moves the port to the VLAN of the first authenticated client. In
this way, a permanent bounce between different VLANs of the switch port is
avoided.
Following are the steps to enable the enhancement :
•
Enable Radius assigned VLANs in Global Configuration command
mode:
2526T(config)#eapol multihost use-radius-assigned-vlan
•
Enable Radius assigned VLANs in interface mode for switch port 1:
2526T(config-if)#eapol multihost port 1 use-radius-assigne
d-vlan
By default, the Radius assigned VLANs in MHMA enhancement is disabled
in global config and interface modes, for all switch ports.
Non-EAP hosts on EAP-enabled ports
For an EAPOL-enabled port configured for non-EAPOL host support, a finite
number of non-EAPOL users or devices with unique MAC addresses are
allowed access to the port.
The following types of non-EAPOL users are allowed:
•
Hosts that match entries in a local list of allowed MAC addresses. You
can specify the allowed MAC addresses when you configure the port to
allow non-EAPOL access. These hosts are allowed on the port without
authentication.
•
Non-EAPOL hosts whose MAC addresses are authenticated by
RADIUS.
•
Nortel IP Phones.
Nortel Ethernet Routing Switch 2500 Series
Security — Configuration and Management
NN47215-505 (323165-B)
02.01
Standard
4.1
19 November 2007
Copyright © 2007, Nortel Networks
.
Summary of Contents for 2526T
Page 227: ......
