Filter
Top Products
5/26/05 Configuring Identity Networking for Operating System
OL-7426-03
Reference [RFC2868] defines RADIUS tunnel attributes used for authentication and authorization, and
[RFC2867] defines tunnel attributes used for accounting. Where the IEEE 802.1X Authenticator
supports tunneling, a compulsory tunnel may be set up for the Supplicant as a result of the
authentication.
In particular, it may be desirable to allow a port to be placed into a particular Virtual LAN (VLAN),
defined in [IEEE8021Q], based on the result of the authentication. This can be used, for example, to
allow a wireless host to remain on the same VLAN as it moves within a campus network.
The RADIUS server typically indicates the desired VLAN by including tunnel attributes within the
Access-Accept. However, the IEEE 802.1X Authenticator may also provide a hint as to the VLAN to be
assigned to the Supplicant by including Tunnel attributes within the Access- Request.
For use in VLAN assignment, the following tunnel attributes are used:
• Tunnel-Type=VLAN (13)
• Tunnel-Medium-Type=802
• Tunnel-Private-Group-ID=VLANID
Note that the VLANID is 12-bits, taking a value between 1 and 4094, inclusive. Since the
Tunnel-Private-Group-ID is of type String as defined in [RFC2868], for use with IEEE 802.1X, the
VLANID integer value is encoded as a string.
When Tunnel attributes are sent, it is necessary to fill in the Tag field. As noted in [RFC2868],
section 3.1:
• The Tag field is one octet in length and is intended to provide a means of grouping attributes in
the same packet which refer to the same tunnel. Valid values for this field are 0x01 through
0x1F, inclusive. If the Tag field is unused, it MUST be zero (0x00).
• For use with Tunnel-Client-Endpoint, Tunnel-Server-Endpoint, Tunnel-Private-Group-ID,
Tunnel-Assignment-ID, Tunnel-Client-Auth-ID or Tunnel-Server-Auth-ID attributes (but not
Tunnel-Type, Tunnel-Medium-Type, Tunnel-Password, or Tunnel-Preference), a tag field of
greater than 0x1F is interpreted as the first octet of the following field.
• Unless alternative tunnel types are provided, (e.g. for IEEE 802.1X Authenticators that may
support tunneling but not VLANs), it is only necessary for tunnel attributes to specify a single
tunnel. As a result, where it is only desired to specify the VLANID, the tag field SHOULD be set
to zero (0x00) in all tunnel attributes. Where alternative tunnel types are to be provided, tag
values between 0x01 and 0x1F SHOULD be chosen.