Ruijie RG-S2900G-E Series, Configuration Manual

Page: 509 / 943

Configuration Guide 802.1x Configuration

It is required to configure the IP address of the authentication server before the Radius-server authentication mode
can operate normally.

You cannot enable 1X authentication on the 802.1Q TUNNEL port.

You cannot enable 1X authentication for Aggregate Port.

If the 1x function is enabled on only one port of a switch, all the port will send the 1x protocol packets to the CPU.

Security addresses of static ports can access the Internet without authentication. If there is authorization, the
addresses must comply with authorization binding to access the Internet. When the port-based transferable
authentication mode and port security are used concurrently, the learned addresses become security addresses and
cannot be transferred.

When the port-based transferable authentication mode and port security are used concurrently, if an authenticated
address is aged securely by a port, the port must be re-authenticated to communicate.

After the port-based transferable authentication mode passes the authentication, and port security is enabled, the
port must be re-authenticated to communicate.

If there is IP and MAC binding, the authentication mode cannot be switched between the port-based one and
user-based one.
Configuring the communication between the device and Radius server
The Radius Server maintains the information of all users: user name, password, authorization information and accounting
information. All users are managed on the Radius Server in a centralized manner, without being distributed over various
switches, making easier management for the administrator.
In order for the switch to normally communicate with the RADIUS SERVER, you must set the following parameters:
Radius Server end: You must register a Radius Client. At registration, you must supply the Radius Server switch’s IP
address, authentication UDP port (add the accounting UDP port, if needed), and the agreed key for communication
between the switch and Radius Server, and select EAP support for the Client. The procedure for registering one Radius
Client on the Radius Server varies with different software settings. Please refer to the appropriate document.
Device end: The following settings are necessary at the device end to ensure the communication between the device and
the server: Configure the IP address of the Radius Server, authentication (accounting) UDP port and the agreed password
for the communication with the server.
In the privileged EXEC mode, you can set the communication between the switch and the Radius Server via the following
steps:
Command Function
Ruijie(config)# aaa new-model Turn on the AAA switch.
Ruijie(config)# radius - server host ip-address [ auth - port port ]
[ acct - port port ]
Configure the RADIUS server.
Ruijie(config)# radius - server key string Configure RADIUS key.
Ruijie# show radius server Show the RADIUS server.
You can use the no radius-server host ip-address auth-port command to restore the authentication UDP port of the
Radius Server to its default. You can use the no radius-server key command to delete the authentication key of the
Radius Server. The following example sets the Server IP as 192.168.4.12, authentication UDP port as 600, and the key as
agreed password: