Extreme Networks ExtremeWare XOS 11.1, Руководство пользователя

Страница: 233 / 496

Network Login
ExtremeWare XOS 11.1 Concepts Guide
233
Exclusions and Limitations
The following are limitations and exclusions for Network Login:
●
All unauthenticated MACs will be seeing broadcasts and multicasts sent to the port if even a single
MAC is authenticated on that port.
●
Network Login must be disabled on a port before that port can be deleted from a VLAN.
●
In Campus mode, once the port moves to the destination VLAN, the original VLAN for that port is
not displayed.
●
A Network Login VLAN port should not be a part of following protocols:
■
EAPS
■
ESRP
■
STP
■
Link Aggregation
●
No Hitless Failover support has been added for Network Login.
●
Rate-limiting is not supported on Network Login ports (both web-based, MAC-based, and 802.1x).
●
Tagged clients are not supported with 802.1x authentication, but are supported for web-based and
MAC-based authentication.
Configuring Network Login
In the following configuration example shows both the Extreme Networks switch configuration, and the
Radius server entries needed to support the example. VLAN
corp is assumed to be a corporate subnet
which has connections to DNS, WINS servers etc. and network routers. VLAN temp is a temporary
VLAN and is created to provide connections to unauthenticated Network Login clients.
Unauthenticated ports belong the VLAN
temp . This kind of configuration provides better security as
unauthenticated clients do not connect to the corporate subnet and will not be able to send or receive
any data. They have to get authenticated in order to have access to the network.
ISP Mode: Network Login clients connected to ports 1:10 - 1:14, VLAN corp , will be logged into the
network in ISP mode. This is controlled by the fact that the VLAN in which they reside in
unauthenticated mode and the RADIUS server Vendor Specific Attributes (VSA),
Extreme-Netlogin-
Vlan
, are the same, corp . So there will be no port movement. Also if this VSA is missing from RADIUS
server, it is assumed to be ISP Mode.
Campus Mode: On the other hand, clients connected to ports 4:1 - 4:4, VLAN temp , will be logged into
the network in Campus mode, since the port will move to the VLAN corp after getting authenticated. A
port moves back and forth from one VLAN to the other as its authentication state changes.
Both ISP and Campus mode are not tied to ports but to a user profile. In other words if the VSA
Extreme:Extreme-Netlogin-Vlan
represents a VLAN different from the one in which user currently
resides, then VLAN movement will occur after login and after logout. In following example, it is
assumed that campus users are connected to ports 4:1-4:4, while ISP users are logged in through ports
1:10-1:14.
NOTE
In the following sample configuration, any lines marked
( Default )
represent default settings and do not need to
be explicitly configured.