Brocade BigIron RX Series Configuration Guide - Manual (Page 1132)

1054 BigIron RX Series Configuration Guide
53-1002484-04
Configuring 802.1x port security
34
Supported RADIUS attributes
Many IEEE 802.1x Authenticators will function as RADIUS clients. Some of the RADIUS attributes
may be received as part of IEEE 802.1x authentication. The BigIron RX supports the following
RADIUS attributes for IEEE 802.1x authentication:
• Username (1) – RFC 2865
• FilterId (11) – RFC 2865
• Vendor-Specific Attributes (26) – RFC 2865
• Tunnel-Type (64) – RFC 2868
• Tunnel-Medium-Type (65) – RFC 2868
• EAP Message (79) – RFC 2579
• Tunnel-Private-Group-Id (81) – RFC 2868
Configuring dynamic VLAN assignment for 802.1x ports
Brocade’s 802.1x implementation supports assigning a port to a VLAN dynamically, based on
information received from an Authentication (RADIUS) Server. If one of the attributes in the
Access-Accept message sent by the RADIUS server specifies a VLAN identifier, and this VLAN
matches a VLAN on the BigIron RX device, the client’s port is moved from its default VLAN to the
specified VLAN. When the client disconnects from the network, the port is placed back in its default
VLAN.
When a client/supplicant successfully completes the EAP authentication process, the
Authentication Server (the RADIUS server) sends the Authenticator (the BigIron RX) a RADIUS
Access-Accept message that grants the client access to the network. The RADIUS Access-Accept
message contains attributes set for the user in the user's access profile on the RADIUS server.
If one of the attributes in the Access-Accept message specifies a VLAN identifier, and this VLAN is
available on the BigIron RX, the client’s port is moved from its default VLAN to the specified VLAN.
When the client disconnects from the network, the port is placed back in its default VLAN.
NOTE
This feature is supported on port-based VLANs only. This feature cannot be used to place an
802.1x-enabled port into a Layer 3 protocol VLAN.
To enable 802.1x VLAN ID support on the BigIron RX, you must add the following attributes to a
user’s profile on the RADIUS server.
The device reads the attributes as follows:
• If the Tunnel-Type or the Tunnel-Medium-Type attributes in the Access-Accept message do not
have the values specified above, the BigIron RX ignores the three Attribute-Value pairs. The
client becomes authorized, but the client’s port is not dynamically placed in a VLAN.
TABLE 171 802.1x VLAN attributes required from the RADIUS server
Attribute name Type Value
Tunnel-Type 064 13 (decimal) – VLAN
Tunnel-Medium-Type 065 6 (decimal) – 802
Tunnel-Private-Group-ID 081 < vlan-name > (string) – either the name or the number of a VLAN
configured on the BigIron RX.