Dell FCX624-I Laptop User Manual


  Open as PDF
of 1494
 
1282 PowerConnect B-Series FCX Configuration Guide
53-1002266-01
Configuring multi-device port authentication
36
If an untagged port had previously been assigned to a VLAN through dynamic VLAN
assignment, and then another MAC address is authenticated on the same port, but the
RADIUS Access-Accept message for the second MAC address specifies a different VLAN, then it
is considered an authentication failure for the second MAC address, and the configured
authentication failure action is performed. Note that this applies only if the first MAC address
has not yet aged out. If the first MAC address has aged out, then dynamic VLAN assignment
would work as expected for the second MAC address.
For dual mode ports, if the RADIUS server returns T:<vlan-name>, the traffic will still be
forwarded in the statically assigned PVID. If the RADIUS server returns U:<vlan-name>, the
traffic will not be forwarded in the statically assigned PVID.
Configuring the RADIUS server to support dynamic VLAN assignment
To specify VLAN identifiers on the RADIUS server, add the following attributes to the profile for the
MAC address on the RADIUS server, then enable dynamic VLAN assignment on multi-device port
authentication-enabled interfaces.
For information about the attributes, refer to “Dynamic multiple VLAN assignment for 802.1X ports”
on page 1231.
Also, refer to the example configuration of “Multi-device port authentication with dynamic VLAN
assignment” on page 1300.
Specifying to which VLAN a port is moved after its RADIUS-specified VLAN
assignment expires
When a port is dynamically assigned to a VLAN through the authentication of a MAC address, and
the MAC session for that address is deleted on the Dell PowerConnect device, then by default the
port is removed from its RADIUS-assigned VLAN and placed back in the VLAN where it was
originally assigned.
A port can be removed from its RADIUS-assigned VLAN when any of the following occur:
The link goes down for the port
The MAC session is manually deleted with the mac-authentication clear-mac-session
command
The MAC address that caused the port to be dynamically assigned to a VLAN ages out
For example, say port 1/1 is currently in VLAN 100, to which it was assigned when MAC address
0007.eaa1.e90f was authenticated by a RADIUS server. The port was originally configured to be in
VLAN 111. If the MAC session for address 0007.eaa1.e90f is deleted, then port 1/1 is moved from
VLAN 100 back into VLAN 111.
Attribute name Type Value
Tunnel-Type 064 13 (decimal) – VLAN
Tunnel-Medium-Type 065 6 (decimal) – 802
Tunnel-Private-Group-ID 081 <vlan-name> (string)
The <vlan-name> value can specify either the name or the number of
one or more VLANs configured on the Dell PowerConnect device.