Configuration Guide Configuring 802.1X
Working Principle
Authorization means to bind the permissions with the users. A user is identified based on the MAC address and VLAN ID, as
mentioned before. Besides MAC-VID binding, some other information such as the VLAN ID are bound with a user to
implement authorization.
 ACL Authorization
After user authentication is complete, the authentication server delivers the ACL or ACE to users. The ACL must be
configured on the authentication server before delivery while no extra configuration is required for ACE delivery. ACL
authorization delivers the ACL based on RADIUS attributes such as standard attributes, Ruijie-proprietary attributes, and
Cisco-proprietary attributes. For details, see the software description related to the RADIUS server.
 Kickoff
Used with RG-SAM/SMP, Ruijie 802.1X server can kick off online users who will be disconnected with the network. This
function applies to the environment where the maximum online period and real-time accounting check function are
configured.
 VLANJump
Wireless 802.1x supports users to be added into the VLAN delivered by the server after authorization. So, the users can
communicate within the VLAN.
4.3.3 Accounting
Accounting allows the network operators to audit the network access or fees of accessed users, including the online time and
traffic.
Working Principle
Accounting is enabled on the NAS. The RADIUS server supports RFC2869-based accounting. When a user goes online, the
NAS sends an accounting start packet to the RADIUS server which then starts accounting. When the user goes offline, the
NAS sends an accounting end packet to the RADIUS server which then completes the accounting and generates a network
fee accounting list. Different servers may perform accounting in different ways. Moreover, not all servers support accounting.
Therefore, refer to the usage guide of the authentication server during actual deployment and accounting.
 Accounting Start
After a user passes authentication, the accounting-enabled switch sends the RADIUS server an accounting start packet
carrying user accounting attributes such as user name and accounting ID. After receiving the packet, the RADIUS server
starts accounting.
 Accounting Update
The NAS periodically sends Accounting Update packets to the RADIUS server, making the accounting more real-time. The
accounting update interval can be provided by the RADIUS server or configured on the NAS.
To Next Page
Loading...
Need help?
General
