C
HAPTER
15
| Security Commands
Network Access Server Commands
– 362 –
DEFAULT SETTING
Disabled
COMMAND USAGE
◆ The RADIUS server must be configured to transmit special RADIUS
attributes to take advantage of this feature.
◆ When globally enabled, the individual port settings determine whether
RADIUS-assigned QoS Class is enabled for that port. When globally
disabled, RADIUS-server assigned QoS Class is disabled for all ports.
◆ When RADIUS-Assigned QoS is both globally enabled and enabled for a
given port, the switch reacts to QoS Class information carried in the
RADIUS Access-Accept packet transmitted by the RADIUS server when
a supplicant is successfully authenticated. If present and valid, traffic
received on the supplicant’s port will be classified to the given QoS
Class. If (re-)authentication fails or the RADIUS Access-Accept packet
no longer carries a QoS Class or it’s invalid, or the supplicant is
otherwise no longer present on the port, the port’s QoS Class is
immediately reverted to the original QoS Class (which may be changed
by the administrator in the meanwhile without affecting the RADIUS-
assigned setting).
◆ This option is only available for single-client modes, i.e. port-based
802.1X and Single 802.1X.
◆ For more information on this option, see the Parameters section under
"Configuring Authentication Through Network Access Servers" on
page 94.
EXAMPLE
Security/Network/NAS>radius_qos global enable
Security/Network/NAS>radius_qos 2 enable
Security/Network/NAS>
security network
nas radius_vlan
This command uses information supplied by a RADIUS server to set the
VLAN on which a successfully authenticated supplicant is placed on the
switch.
SYNTAX
security network nas radius_vlan [global | port-list] [enable |
disable]
global - Applies this command globally to the switch.
port-list - Applies this command to a specific port or a range of
ports. (Range: 1-28 or all)
enable - Enables RADIUS-server assigned VLAN membership.
disable - Disables RADIUS-server assigned VLAN membership.
To Next Page
