DGS-1510/ME Series Metro Ethernet Switch CLI Reference Guide
648
To assign
VLAN by RADIUS Server
, the proper parameters should be configured on the RADIUS Server. To use
VLAN assignment, RFC3580 defines the following tunnel attributes in RADIUS packets.
The table below shows the parameters for a VLAN:
RADIUS Tunnel Attribute
Description
Value
Usage
Tunnel-Type
This attribute indicates the tunneling protocol(s)
to be used (in the case of a tunnel initiator) or
the tunneling protocol in use (in the case of a
tunnel terminator).
13 (VLAN)
Required
Tunnel-Medium-Type
This attribute indicates the transport medium
being used.
6 (802)
Required
Tunnel-Private-Group-ID
This attribute indicates group ID for a particular
tunneled session.
A string (VID)
Required
If the user has configured the VLAN attribute of the RADIUS server (for example, VID 3) and the 802.1X, or
MAC-based Access Control authentication is successful, the port will be added to VLAN 3. However, if the user
does not configure the VLAN attribute and authenticates successfully, the port will be kept in its original VLAN. If
the VLAN attribute configured on the RADIUS server does not exist, the port will not be assigned to the requested
VLAN.
To assign
ACL by RADIUS Server
, the proper parameters should be configured on the RADIUS Server. The table
below shows the parameters for an ACL. The RADIUS ACL assignment is only used in MAC-based Access
Control.
The parameters of the Vendor-Specific Attribute are:
RADIUS Tunnel Attribute
Description
Value
Usage
Vendor-ID
Defines the vendor.
171 (DLINK)
Required
Vendor-Type
Defines the attribute.
12 (for ACL profile)
13 (for ACL rule)
Required
Attribute-Specific Field
Used to assign the ACL
profile or rule.
ACL Command
For example:
ACL profile:
create
access_profile profile_id 1
profile_name profile1 ethernet
vlan 0xFFF
;
ACL rule:
config access_profile
profile_id 1 add access_id
auto_assign ethernet vlan_id 1
port all deny
;
Required
If the user has configured the ACL attribute of the RADIUS server (for example, ACL profile:
create
access_profile profile_id 1 profile_name profile1 ethernet vlan 0xFFF
; ACL rule:
config access_profile
profile_id 1 add access_id auto_assign ethernet vlan_id 1 port all deny
), and the MAC-based Access Control
authentication is successful, the device will assign the ACL profiles and rules according to the RADIUS server. For
more information about the ACL module, please refer to Chapter 6 Access Control List (ACL) Command List.
Содержание DGS-1510/ME Series
Страница 1: ......