134 Dell PowerConnect 55xx Systems User Guide
FILE LOCATION: C:\Users\gina\Desktop\Checkout_new\Maintenance Projects\Dell
Contax\CxU_Switching_NetworkSecurity.fm
DELL CONFIDENTIAL – PRELIMINARY 9/11/12 - FOR PROOF ONLY
Dynamic VLAN Assignment (DVA)
Dynamic VLAN Assignment (DVA) is also referred to as RADIUS VLAN
Assignment in this guide. When a port is in Multiple Session mode and is
DVA-enabled, the switch automatically adds the port as an untagged member
of the VLAN that is assigned by the RADIUS server during the authentication
process. The switch classifies untagged packets to the assigned VLAN if the
packets originated from the devices or ports that are authenticated and
authorized.
For a device to be authenticated and authorized at a DVA-enabled port:
• The RADIUS server must authenticate the device and dynamically assign
a VLAN to the device.
• The assigned VLAN must not be the default VLAN and must have been
created on the switch.
• The switch must not be configured to use both a DVA and a MAC-based
VLAN group.
• A RADIUS server must support DVA with RADIUS attributes tunnel-type
(64) = VLAN (13), tunnel-media-type (65) = 802 (6), and tunnel-private-
group-id = a VLAN ID.
Dynamic Policy/ACL Assignment
The Dynamic Policy/ACL Assignment feature enables specifying a user-
defined ACL or policy in the RADIUS server. After a successful
authentication, the user is assigned that ACL.
Authentication Methods
The possible authentication methods are:
•
Dot1x
— The switch supports this authentication mechanism, as
described in the standard, to authenticate and authorize Dot1x
supplicants.
•
MAC-based
— The switch can be configured to use this method to
authenticate and authorize devices that do not support Dot1x. The switch
emulates the supplicant role on behalf of the non-Dot1x-capable devices,
and uses the MAC address of the devices as the username and password,
when communicating with the RADIUS servers. MAC addresses for
To Next Page
Loading...
