Enterasys 802.1Q Especificaciones descargar pdf (Pagina 5)

Authentication Overview

April 15, 2011 Page 5 of 36

Multi-User Authentication

Multi‐userauthenticationprovidesfortheper‐userorper‐deviceprovisioningofnetwork

resourceswhenauthenticating.Itsupportstheabilitytoreceivefromtheauthenticationserver:

•Apolicytrafficprofile,basedontheuseraccount’sRADIUSFilter‐IDconfiguration

•AbaseVLAN‐ID,basedontheRFC3580tunnelattributesconfiguration,

alsoknownas

dynamicVLANassignment

Whenasinglesupplicantconnectedtoanaccess layerportauthenticates,apolicyprofilecanbe

dynamicallyappliedtoalltrafficontheport.Whenmulti ‐userauthenticationisnot implemented,

andmorethanonesupplicantisconnectedtoaport,firmwaredoesnotprovision

network

resourcesonaper‐userorper‐devicebasis.Differentusersordevicesmayrequireadifferentset

ofnetworkresources.ThefirmwaretracksthesourceMACaddressforeachauthenticatinguser

regardlessoftheauthenticatingprotocolbeingused.Provisioningnetworkresourcesona

per‐userbasisisaccomplished

byapplyingthepolicyconfiguredintheRADIUSFilter‐ID,orthe

baseVLAN‐IDconfiguredintheRFC3580tunnelattributes,foragivenuser’sMACaddress.The

RADIUSFilter‐IDandtunnelattributesarepartoftheRADIUSuseraccountandareincludedin

theRADIUSAcceptmessageresponse

fromtheauthenticationserver.

Thenumberofallowedusersperportcanbeconfiguredusingthesetmultiauthportnumusers

command.Theshowmultiauthportcommanddisplaysboththeallowednumberofusers

configuredandthemaximumnumberofuserssupportedperportforthedevice.Theallowed

numberofusers

defaultstothemaximumnumberofsupportedusersfortheportforamodular

switchplatformandto1forthestackablefixedswitchandstandal onefixedswitchplatforms.

InFigure 1eachuseronportge.1.5sendsanauthenticationrequesttotheRADIUSserver.Based

upontheSourceMACaddress(SMAC),

RADIUSlooksuptheaccountforthatuserandincludes

theFilter‐IDassociatedwiththataccountintheauthenticationresponsebacktotheswitch(see

section“TheRADIUSFilter‐ID”onpage 9forFilter‐IDinformation).Thepolicyspecifiedinthe

Filter‐IDisthenappliedtothe

user.SeesectionRFC3580onpage 10forinformationondynamic

VLANassignmentandtunnelattributeconfiguration.

Note: Multi-user authentication on stackable fixed switch and standalone fixed switch platforms

requires that the switch be the point of authentication, in order to apply policy.

1 2 3 4 5 6 7 8 9 10 ... 35 36

Sin comentarios

Enterasys 802.1Q Especificaciones Pagina 5