Dell PowerConnect 5548 User Guide - Page 129

Dynamic VLAN Assignment (DVA) Dynamic VLAN Assignment (DVA) is also referred to as RADIUS VLAN Assignment in this guide. When a port is in Multiple Session mode and is DVA-enabled, the switch automatically adds the port as an untagged member of the VLAN that is assigned by the RADIUS server during the authentication process. The switch classifies untagged packets to the assigned VLAN if the packets originated from the devices or ports that are authenticated and authorized. For a device to be authenticated and authorized at a DVA-enabled port: • The RADIUS server must authenticate the device and dynamically assign a VLAN to the device. • The assigned VLAN must not be the default VLAN and must have been created on the switch. • The switch must not be configured to use both a DVA and a MAC-based VLAN group. • A RADIUS server must support DVA with RADIUS attributes tunnel-type (64) = VLAN (13), tunnel-media-type (65) = 802 (6), and tunnel-privategroup-id = a VLAN ID. Dynamic Policy/ACL Assignment The Dynamic Policy/ACL Assignment feature enables specifying a userdefined ACL or policy in the RADIUS server. After a successful authentication, the user is assigned that ACL. Authentication Methods The possible authentication methods are: • Dot1x - The switch supports this authentication mechanism, as described in the standard, to authenticate and authorize Dot1x supplicants. • MAC-based - The switch can be configured to use this method to authenticate and authorize devices that do not support Dot1x. The switch emulates the supplicant role on behalf of the non-Dot1x-capable devices, and uses the MAC address of the devices as the username and password, when communicating with the RADIUS servers. MAC addresses for Dell PowerConnect 55xx Systems User Guide 129