ZyXEL Communications XS3800-28, User Manual, Page: 551 / 789

Chapter 74 AAA
XS3800-28 User’s Guide
551
• Limit bandwidth on incoming or outgoing traffic for the port the user connects to.
• Assign account privilege levels (See the CLI Reference Guide for more information on account
privilege levels) for the authenticated user.
The VSAs are composed of the following:
• Vendor-ID : An identification number assigned to the company by the IANA (Internet Assigned
Numbers Authority). Zyxel’s vendor ID is 890.
• Vendor-Type : A vendor specified attribute, identifying the setting you want to modify.
• Vendor-data : A value you want to assign to the setting.
Note: Refer to the documentation that comes with your RADIUS server on how to configure
VSAs for users authenticating through the RADIUS server.
The following table describes the VSAs supported on the Switch.
The following table describes the VSAs supported on the Switch. Note that these attributes only work
when you enable authorization (see
Section 74.4 on page 547 ).
74.5.1.1 Tunnel Protocol Attribute
You can configure tunnel protocol attributes on the RADIUS server (refer to your RADIUS server
documentation) to assign a port on the Switch to a VLAN based on IEEE 802.1x authentication. The port
VLAN settings are fixed and untagged. This will also set the port’s VID. The following table describes the
values you need to configure. Note that these attributes only work when you enable authorization (see
Section 74.4 on page 547 ).
Table 294 Supported VSAs
FUNCTION ATTRIBUTE
Ingress Bandwidth
Assignment
Vendor-Id = 890
Vendor-Type = 1
Vendor-data =
ingress rate (Kbps in decimal format)
Egress Bandwidth
Assignment
Vendor-Id = 890
Vendor-Type = 2
Vendor-data =
egress rate (Kbps in decimal format)
Privilege Assignment
Vendor-ID = 890
Vendor-Type =
3
Vendor-Data = " shell:priv-lvl= N"
or
Vendor-ID = 9
(CISCO)
Vendor-Type = 1
(CISCO-AVPAIR)
Vendor-Data = " shell:priv-lvl= N"
where
N
is a privilege level (from 0 to 14).
Note: If you set the privilege level of a login account differently on the RADIUS
servers and the Switch, the user is assigned a privilege level from the
database (RADIUS or local) the Switch uses first for user authentication.