Juniper JUNOS OS 10.3 - SOFTWARE, Руководство пользователя

Страница: 2717 / 3946

Applying a Port Firewall Filter from the RADIUS Server
You can apply a firewall filter to user policies on the RADIUS server. The RADIUS server
can then specify the firewall filters that are to be applied to each user that requests to
authenticate. Use this method when the firewall filter has more extensive conditions or
you want to use different conditions for the same filter on different switches. The firewall
filters must be configured on each switch.
For more information about firewall filters, see “Firewall Filters for EX Series Switches
Overview” on page 3001.
To apply a port firewall filter centrally from the RADIUS server:
NOTE: If port firewall filters are also configured locally for the interface, then
VSAs take precedence if they conflict with the filters. If the VSAs and the
local port firewall filters do not conflict, they are merged.
1.
Create the firewall filter on the local switch. In this example, the filter is called filter1 .
2.
Open the users file on the RADIUS server:
[root@freeradius]#
cd /usr/local/pool/raddb
vi users
3.
For each relevant user, add the filter (here, the filter ID is
filter1
):
Filter-Id = "filter1"
NOTE: Multiple filters are not supported on a single interface. However,
you can support multiple filters for multiple users that are connected to
the switch on the same interface by configuring a single filter with policies
for each of those users.
4.
Stop and restart the RADIUS process to activate the configuration.
Related
Documentation
•
Example: Applying a Firewall Filter to 802.1X-Authenticated Supplicants Using RADIUS
Server Attributes on an EX Series Switch on page 2574
•
Example: Configuring Firewall Filters for Port, VLAN, and Router Traffic on EX Series
Switches on page 3039
•
Configuring 802.1X Interface Settings (CLI Procedure) on page 2609
•
Understanding 802.1X and VSAs on EX Series Switches on page 2544
2621 Copyright © 2010, Juniper Networks, Inc.
Chapter 83: Configuring Access Control