Enterasys Networks D-Series - Manual (Page 507)

Configuring VLAN Authorization (RFC 3580)
Enterasys D-Series CLI Reference 17-45
Configuring VLAN Authorization (RFC 3580)
Purpose
RFC 3580 Tunnel Attributes provide a mechanism to contain an 802.1X authenticated or a MAC
authenticated user to a VLAN regardless of the PVID.
Please see section 3‐31 of RFC 3580 for details on configuring a RADIUS server to return the
desired tunnel attributes. As stated in RFC 3580, “... it may be desirable to allow a port to be placed
into a particular Virtual LAN (VLAN), defined in [IEEE8021Q], based on the result of the
authentication.”
The RADIUS server typically indicates the desired VLAN by including tunnel attributes within its
Access‐Accept parameters. However, the IEEE 802.1X or MAC authenticator can also be
configured to instruct the VLAN to be assigned to the supplicant by including tunnel attributes
within Access‐Request parameters.
The following tunnel attributes are used in VLAN authorization assignment, :
• Tunnel‐Type ‐ VLAN (13)
• Tunnel‐Medium‐Type ‐ 802
• Tunnel‐Private‐Group‐ID ‐ VLANID
In order to authenticate multiple RFC 3580 users, policy maptable response must be set to tunnel
as described in this section.
Commands
show policy maptable response
Displays the current policy maptable response setting. When VLAN authorization is enabled (as
described in this section) and the policy maptable response is tunnel, you can use the set
Notes: The D2 cannot simultaneously support Policy and RFC 3580 on the same port. If multiple
users are configured to use a port, and the D2 is then switched from "policy" mode to RFC-3580
"tunnel" mode, the total number of users supported to use a port will be reset to one.
A policy license, if applicable, is not required to run RFC3580.
For information about... Refer to page...
show policy maptable response 17-45
set policy maptable response 17-46
set vlanauthorization 17-47
set vlanauthorization egress 17-48
clear vlanauthorization 17-48
show vlanauthorization 17-49