C
HAPTER
14
| Security Measures
Network Access (MAC Address Authentication)
– 279 –
◆ Any unsupported profiles in the Filter-ID attribute are ignored.
For example, if the attribute is “map-ip-dscp=2:3;service-policy-
in=p1,” then the switch ignores the “map-ip-dscp” profile.
◆ When authentication is successful, the dynamic QoS information may
not be passed from the RADIUS server due to one of the following
conditions (authentication result remains unchanged):
■
The Filter-ID attribute cannot be found to carry the user profile.
■
The Filter-ID attribute is empty.
■
The Filter-ID attribute format for dynamic QoS assignment is
unrecognizable (can not recognize the whole Filter-ID attribute).
◆ Dynamic QoS assignment fails and the authentication result changes
from success to failure when the following conditions occur:
■
Illegal characters found in a profile value (for example, a non-digital
character in an 802.1p profile value).
■
Failure to configure the received profiles on the authenticated port.
◆ When the last user logs off on a port with a dynamic QoS assignment,
the switch restores the original QoS configuration for the port.
◆ When a user attempts to log into the network with a returned dynamic
QoS profile that is different from users already logged on to the same
port, the user is denied access.
◆ While a port has an assigned dynamic QoS profile, any manual QoS
configuration changes only take effect after all users have logged off
the port.
CONFIGURING GLOBAL
SETTINGS FOR
NETWORK ACCESS
MAC address authentication is configured on a per-port basis, however
there are two configurable parameters that apply globally to all ports on
the switch. Use the Security > Network Access (Configure Global) page to
configure MAC address authentication aging and reauthentication time.
CLI REFERENCES
◆ "Network Access (MAC Address Authentication)" on page 641
PARAMETERS
These parameters are displayed:
◆ Aging Status – Enables aging for authenticated MAC addresses stored
in the secure MAC address table. (Default: Disabled)
This parameter applies to authenticated MAC addresses configured by
the MAC Address Authenticataion process described in this section, as
well as to any secure MAC addresses authenticated by 802.1X,
regardless of the 802.1X Operation Mode (Single-Host, Multi-Host, or
MAC-Based authentication as described on page 328).
To Next Page
Loading...
Need help?
General