Dell N3200-ON Networking N-Series Switches CLI Reference Guide version 6.8.0 - Page 1043

assigned VLAN does not exist on the supplicant connected interface, the assigned VLAN is dynamically created. See the aaa authorization network default radius command for further information. This implies that the client can connect from any port and be assigned to the appropriate VLAN, which may be already configured on an uplink interface. This gives flexibility for clients to move around the network with out requiring the operator to perform additional provisioning for each network interface. Dynamic VLAN assignment uses the following RADIUS attributes from the received AccessAccept: IETF 64 (Tunnel Type)-Set this to VLAN. IETF 65 (Tunnel Medium Type)-Set this to 802. IETF 81 (Tunnel Private Group ID)-Set this to VLAN ID or VLAN name. RADIUS Change of Authorization Dell Networking supports the Change of Authorization Disconnect -Request per RFC 3575. The Dell Networking switch listens for the DisconnectRequest on UDP port 3799. The Disconnect-Request identifies the user session to be terminated using the following attributes: • User-Name (IETF attribute #1) • Acct-Session-Id (IETF attribute #44) • Calling-Station-Id (IETF attribute #31, which contains the host MAC address) The following messages from RFC 3575 are supported: • 40 - Disconnect-Request • 41 - Disconnect-ACK • 42 - Disconnect-NAK A CoA Disconnect-Request terminates the session without disabling the switch port. Instead, CoA Disconnect-Request termination causes reinitialization of the authenticator state machine for the specified host. MACbased port control can be enabled for 802.1x sessions. In this case, if the RADIUS server issues a disconnect request and subsequently does not authorize the MAC address to access network resources, the host is effectively Security Commands 1043