Brocade Multi-Service IronWare Security Configuration Guide (Supporting R05.6.00) - Manual (Page 323)

Multi-Service IronWare Security Configuration Guide 305
53-1003035-02
Configuring 802.1x port security
8
Supported RADIUS attributes
Many IEEE 802.1x Authenticators will function as RADIUS clients. Some of the RADIUS attributes
may be received as part of IEEE 802.1x authentication. The device supports the following RADIUS
attributes for IEEE 802.1x authentication:
• Username (1) – RFC 2865
• FilterId (11) – RFC 2865
• Vendor-Specific Attributes (26) – RFC 2865
• Tunnel-Type (64) – RFC 2868
• Tunnel-Medium-Type (65) – RFC 2868
• EAP Message (79) – RFC 2579
• Tunnel-Private-Group-Id (81) – RFC 2868
Configuring dynamic VLAN assignment for
802.1x ports
Brocade’s 802.1x implementation supports assigning a port to a VLAN dynamically, based on
information received from an Authentication (RADIUS) Server. If one of the attributes in the
Access-Accept message sent by the RADIUS server specifies a VLAN identifier, and this VLAN
matches a VLAN on the device, the client’s port is moved from its default VLAN to the specified
VLAN. When the client disconnects from the network, the port is placed back in its default VLAN.
When a client or supplicant successfully completes the EAP authentication process, the
Authentication Server (the RADIUS server) sends the Authenticator (the device) a RADIUS
Access-Accept message that grants the client access to the network. The RADIUS Access-Accept
message contains attributes set for the user in the user's access profile on the RADIUS server.
If one of the attributes in the Access-Accept message specifies a VLAN identifier, and this VLAN is
available on the device, the client’s port is moved from its default VLAN to the specified VLAN.
When the client disconnects from the network, the port is placed back in its default VLAN.
NOTE
This feature is supported on port-based VLANs only. This feature cannot be used to place an
802.1x-enabled port into a Layer 3 protocol VLAN.
To enable 802.1x VLAN ID support on the device, you must add the following attributes to a user’s
profile on the RADIUS server.
The device reads the attributes as follows:
• If the Tunnel-Type or the Tunnel-Medium-Type attributes in the Access-Accept message do not
have the values specified above, the device ignores the three Attribute-Value pairs. The client
becomes authorized, but the client’s port is not dynamically placed in a VLAN.
TABLE 48 802.1x VLAN attributes required from the RADIUS server
Attribute name Type Value
Tunnel-Type 064 13 (decimal) – VLAN
Tunnel-Medium-Type 065 6 (decimal) – 802
Tunnel-Private-Group-ID 081 vlan-name (string) – either the name or the number of a VLAN
configured on the device.