Ruijie RG-S2900G-E Series, Configuration Manual

Page: 535 / 943

Configuration Guide 802.1x Configuration
Configuring Dynamic Acl Assignment
802.1x supports ACL assignment from server and dynamic installation of the assigned ACL. Our product support installing
acl by default. They will install acl dynamically on condition that the allowed acl is set on the server and is assigned after
the successful user authentication.
To implement dynamic acl assignment, you need to set the port as mac-based authentication mode or port-based
single-user authentication mode. For the configuration, please refer to the related command configuration manual.
In single-host authentication mode, it supports to renew acl when reauthenticating. That is, acl takes effect
when the authenticated user sets acl on the server and reauthenticates.
The mac-based authentication mode does not support ACL update when re-authenticating. That is to say,
ACL of the authenticated user can only be assigned once. The new acl is ignored and the original acl
remains if the acl changes when re-authenticating.
Supported acl type: extension type which can explain acl function on our switch.
Execute the following command if you need to support dynamic acl assignment on the server which is not authenticated
by our company.
Ruijie# configure terminal
Ruijie(config)# radius vendor-specific extend
Configuring Dot1x MAC Authentication Bypass
GUEST VLAN provides a method of network accessing without the 802.1x authentication client, but this technology is
unable to determine whether the access device is secure or insecure. In some conditions, for the network management
and security, although there is no 802.1x authentication client, the administrator still needs to control the validity of the
access device. MAB (MAC Authentication Bypass) provides a solution for this application.
With the MAB function enabled on the 802.1x authentication port, the authentication request packets are sent
continuously to the port and the client response is expected. If there is no client response within the time of
“tx-period*reauth-max”, the MAC address learned on the 802.1x authentication port will be monitored, and the
authentication will be initiated by sending the username (the learned MAC address) and keyword to the server. It
determines whether the learned MAC address is accessible to the network or not according to the returned authentication
result from the server.
To configure the MAB function, run the following commands:
Command Function
Ruijie(config)# interface interface-id
Enter interface configuration mode.
Ruijie(config-if- type ID )# dot1x mac - auth - bypass Set the dot1x MAC authentication bypass.
Ruijie# show running-config Show all configurations.