Alcatel 9000 Guía de usuario descargar pdf (Pagina 470)

100

101

Configuring Access Guardian Policies Configuring 802.1X

page 23-14 OmniSwitch 6800/6850/9000 Network Configuration Guide June 2006

This command drops connectivity on port 1 of slot 3. The switch sends out a Request Identity message and

restores connectivity when the port is successfully re-authenticated.

Configuring Accounting for 802.1X

To log 802.1X sessions, use the aaa accounting 802.1x command with the desired RADIUS server

names; use the keyword local to specify that the Switch Logging function in the switch should be used to

log 802.1X sessions. RADIUS servers are configured with the aaa radius-server command.

-> aaa accounting 802.1x rad1 local

In this example, the RADIUS server rad1 will be used for accounting. If rad1 becomes unavailable, the

local Switch Logging function in the switch will log 802.1X sessions. For more information about Switch

Logging, see Chapter 30, “Using Switch Logging.”

Configuring Access Guardian Policies

The Access Guardian provides functionality that allows the configuration of 802.1x device classification

policies for supplicants (802.1x clients) and non-supplicants (non-802.1x clients). This functionality is

only available on the OmniSwitch 6800 and 6850 switches at this time. See “Using Access Guardian Poli-

cies” on page 23-9 for more information.

Configuring device classification policies is only supported on mobile, 802.1x enabled ports. In addition,

the port control status for the port must allow auto authorization. See “Setting Up Port-Based Network

Access Control” on page 23-11 for specific information about how to enable 802.1x functionality on a

port.

As described in “Using Access Guardian Policies” on page 23-9, there are several types of policies that

when combined together create either a supplicant or non-supplicant compound policy. Consider the

following when configuring compound policies:

• A single policy can only appear once for a pass condition and once for a failed condition in a

compound policy.

• Up to three VLAN ID policies are allowed within the same compound policy, as long as the ID number

is different for each instance specified (e.g., vlan 20 vlan 30 vlan 40).

• Compound policies must terminate. The last policy must result in either blocking the device or assign-

ing the device to the default VLAN. If a terminal policy is not specified then the block policy is used

by default.

• The order in which policies are configured determines the order in which the policies are applied.

The following table provides examples of policies that were incorrectly configured and a description of the

problem:

Incorrect Policy Command Problem

802.1x 1/45 supplicant policy authentication pass

group-mobility vlan 200 group-mobility fail

block

The group-mobility policy is specified more than

once as a pass condition.

802.1x 1/24 non-supplicant policy authentication

pass vlan 20 vlan 30 vlan 40 vlan 50 fail block

More than three VLAN ID policies are specified

in the same command.

1 2 ... 465 466 467 468 469 470 471 472 473 474 475 ... 701 702

Comentarios a estos manuales

Sin comentarios

Alcatel 9000 Guía de usuario Pagina 470

Comentarios a estos manuales

Relacionado con productos y manuales para Software Alcatel 9000