Home » Dell Manuals » Hubs & Switches » Dell PowerConnect 8100 » Manual Viewer

Dell PowerConnect 8100 User's Configuration Guide - Page 504

cl-ssh, cl-http, con-pol, Configuration Examples on The example Providing Subnets

View all Dell PowerConnect 8100 manuals

Add to My Manuals
Save this manual to your list of manuals

Page 504 highlights

• The RADIUS or 802.1X server must specify the policy to assign. For example, if the DiffServ policy to assign is named internet_access, include the following attribute in the RADIUS or 802.1X server configuration: Filter-id = "internet_access" • The DiffServ policy specified in the attribute must already be configured on the switch, and the policy names must be identical. For information about configuring a DiffServ policy, see "DiffServ Configuration Examples" on page 1136. The example "Providing Subnets Equal Access to External Network" on page 1136, describes how to configure a policy named internet_access. If you use an authentication server to assign DiffServ policies to an authenticated user, note the following guidelines: • If the policy specified within the server attribute does not exist on the switch, authentication will fail. • Do not delete policies used as the filter ID in the RADIUS server while 802.1X is enabled. • Do not use the DiffServ service-policy command to apply the filter to an interface if you configure the RADIUS server or 802.1X authenticator to assign the DiffServ filter. In the following example, Company XYZ uses IEEE 802.1X to authenticate all users. Contractors and temporary employees at Company XYZ are not permitted to have access to SSH ports, and data rates for Web traffic is limited. When a contractor is authenticated by the RADIUS server, the server assigns a DiffServ policy to control the traffic restrictions. The network administrator configures two DiffServ classes: cl-ssh and cl-http. The class cl-ssh matches all incoming SSH packets. The class cl-http matches all incoming HTTP packets. Then, the administrator configures a traffic policy called con-pol and adds the cl-ssh and cl-http. The policy is configured so that that SSH packets are to be dropped, and HTTP data rates are limited to 1 MB with a burst size of 64 Kbps. HTTP traffic that exceeds the limit is dropped. The host ports, ports 1-23, are configured to use MAC-based dot1X authentication to allow the DiffServ policy to be applied. Finally, the administrator configures the RADIUS server with the attribute Filter-id = "con-pol". 504 Configuring Port and System Security

Section	Page
Introduction	49
About This Document	49
Audience	50
Document Conventions	50
Additional Documentation	51
Switch Features	53
System Management Features	54
Multiple Management Options	54
System Time Management	54
Log Messages	55
Integrated DHCP Server	56
Management of Basic Network Information	56
IPv6 Management Features	56
Dual Software Images	56
File Management	57
Switch Database Management Templates	57
Automatic Installation of Firmware and Configuration	57
sFlow	58
SNMP Alarms and Trap Logs	58
CDP Interoperability through ISDP	58
Remote Monitoring (RMON)	58
Stacking Features	59
High Port Count	59
Single IP Management	59
Automatic Firmware Update for New Stack Members	59
Master Failover with Transparent Transition	60
Nonstop Forwarding on the Stack	60
Hot Add/Delete and Firmware Synchronization	60
Security Features	60
Configurable Access and Authentication Profiles	60
Password-Protected Management Access	61
Strong Password Enforcement	61
TACACS+ Client	61
RADIUS Support	61
SSH/SSL	62
Inbound Telnet Control	62
Denial of Service	62
Port Protection	62
Captive Portal	63
Dot1x Authentication (IEEE 802.1X)	63
MAC-Based 802.1X Authentication	63
Dot1x Monitor Mode	64
MAC-Based Port Security	64
Access Control Lists (ACL)	64
Time-Based ACLs	65
IP Source Guard (IPSG)	65
DHCP Snooping	65
Dynamic ARP Inspection	65
Protected Ports (Private VLAN Edge)	66
Switching Features	66
Flow Control Support (IEEE 802.3x)	66
Head of Line Blocking Prevention	66
Alternate Store and Forward (ASF)	66
Jumbo Frames Support	67
Auto-MDI/MDIX Support	67
VLAN-Aware MAC-based Switching	67
Back Pressure Support	67
Auto Negotiation	68
Broadcast Storm Control	68
Port Mirroring	68
Static and Dynamic MAC Address Tables	69
Link Layer Discovery Protocol (LLDP)	69
Link Layer Discovery Protocol (LLDP) for Media Endpoint Devices	69
Priority-based Flow Control (PFC)	69
Data Center Bridging Exchange (DBCx) Protocol	70
Enhanced Transmission Selection	70
Fibre Channel over Ethernet (FCoE) Initialization Protocol Snooping	70
Cisco Protocol Filtering	71
DHCP Layer 2 Relay	71
Virtual Local Area Network Supported Features	71
VLAN Support	71
Port-Based VLANs	71
IP Subnet-based VLAN	72
MAC-based VLAN	72
IEEE 802.1v Protocol-Based VLANs	72
GARP and GVRP Support	72
Voice VLAN	72
Guest VLAN	73
Double VLANs	73
Spanning Tree Protocol Features	74
Spanning Tree Protocol (STP)	74
Spanning Tree Port Settings	74
Rapid Spanning Tree	74
Multiple Spanning Tree	74
Bridge Protocol Data Unit (BPDU) Guard	75
BPDU Filtering	75
Link Aggregation Features	75
Link Aggregation	75
Link Aggregate Control Protocol (LACP)	75
Routing Features	77
Address Resolution Protocol (ARP) Table Management	77
VLAN Routing	77
IP Configuration	77
Open Shortest Path First (OSPF)	77
BOOTP/DHCP Relay Agent	78
IP Helper and UDP Relay	78
Routing Information Protocol	78
Router Discovery	78
Routing Table	78
Virtual Router Redundancy Protocol (VRRP)	79
Tunnel and Loopback Interfaces	79
IPv6 Routing Features	79
IPv6 Configuration	79
IPv6 Routes	80
OSPFv3	80
DHCPv6	80
Quality of Service (QoS) Features	81
Differentiated Services (DiffServ)	81
Class Of Service (CoS)	81
Auto Voice over IP (VoIP)	81
Internet Small Computer System Interface (iSCSI) Optimization	82
Layer 2 Multicast Features	82
MAC Multicast Support	82
IGMP Snooping	82
IGMP Snooping Querier	83
MLD Snooping	83
Multicast VLAN Registration	83
Layer 3 Multicast Features	84
Distance Vector Multicast Routing Protocol	84
Internet Group Management Protocol	84
IGMP Proxy	84
Protocol Independent Multicast—Dense Mode	84
Protocol Independent Multicast—Sparse Mode	85
Protocol Independent Multicast—Source Specific Multicast	85
Protocol Independent Multicast IPv6 Support	85
MLD/MLDv2 (RFC2710/RFC3810)	85
Hardware Overview	87
PowerConnect 8000-series and 8100-series Front Panel	87
PowerConnect 8024 Front Panel	87
PowerConnect 8024F Front Panel	88
PowerConnect 8132 Front Panel	89
PowerConnect 8132F Front Panel	89
PowerConnect 8164 Front Panel	90
PowerConnect 8164F Front Panel	91
Hot-Pluggable Interface Modules	92
USB Port (Power Connect 8100-series switches only)	94
Port and System LEDs	94
PowerConnect 8000-series and 8100-series Back Panel	94
Console Port	96
Out-of-Band Management Port	96
Power Supplies	96
Ventilation System	96
LED Definitions	97
Port LEDs	97
Module Bay LEDs	98
Out-of-Band Ethernet Management Port LEDs	99
System LEDs	99
Switch Addresses	100
Using Dell OpenManage Switch Administrator	103
About Dell OpenManage Switch Administrator	103
Starting the Application	104
Understanding the Interface	105
Defining Fields	107
Understanding the Device View	108
Using the Device View Port Features	108
Using the Command-Line Interface	109
Accessing the Switch Through the CLI	109
Console Connection	109
Telnet Connection	110
Understanding Command Modes	111
Entering CLI Commands	113
Using the Question Mark to Get Help	113
Using Command Completion	114
Entering Abbreviated Commands	114
Negating Commands	114
Understanding Error Messages	115
Recalling Commands from the History Buffer	115
Default Settings	117
Setting the IP Address and Other Basic Network Information	121
IP Address and Network Information Overview	121
What Is the Basic Network Information?	121
Why Is Basic Network Information Needed?	122
How Is Basic Network Information Configured?	123
What Is Out-of-Band Management and In-Band Management?	123
Default Network Information	125
Configuring Basic Network Information (Web)	126
Out-of-Band Interface	126
IP Interface Configuration (Default VLAN IP Address)	127
Route Entry Configuration (Switch Default Gateway)	128
Domain Name Server	130
Default Domain Name	131
Host Name Mapping	132
Dynamic Host Name Mapping	133
Configuring Basic Network Information (CLI)	134
Enabling the DHCP Client on the OOB Port	134
Enabling the DHCP Client on the Default VLAN	134
Managing DHCP Leases	135
Configuring Static Network Information on the OOB Port	136
Configuring Static Network Information on the Default VLAN	136
Configuring and Viewing Additional Network Information	137
Basic Network Information Configuration Example	138
Managing QSFP Ports	141
Managing a Switch Stack	143
Stacking Overview	143
Creating a PowerConnect 8000/8100 Series Stack	145
How is the Stack Master Selected?	146
Adding a Switch to the Stack	148
Removing a Switch from the Stack	148
How is the Firmware Updated on the Stack?	149
What is Stacking Standby?	149
What is Nonstop Forwarding?	150
Switch Stack MAC Addressing and Stack Design Considerations	153
NSF Network Design Considerations	153
Why is Stacking Needed?	154
Default Stacking Values	154
Managing and Monitoring the Stack (Web)	155
Unit Configuration	155
Stack Summary	157
Stack Firmware Synchronization	158
Supported Switches	159
Stack Port Summary	160
Stack Port Counters	161
Stack Port Diagnostics	161
NSF Summary	162
Checkpoint Statistics	163
Managing the Stack (CLI)	164
Configuring Stack Member, Stack Port, and NSF Settings	164
Viewing and Clearing Stacking and NSF Information	166
Stacking and NSF Usage Scenarios	166
Basic Failover	167
Preconfiguring a Stack Member	169
NSF in the Data Center	171
NSF and VoIP	172
NSF and DHCP Snooping	173
NSF and the Storage Access Network	174
NSF and Routed Access	176
Configuring Authentication, Authorization, and Accounting	179
AAA Overview	179
Methods	180
Access Lines	181
Authentication	181
Authorization	182
Exec Authorization Capabilities	183
Accounting	184
Authentication Examples	185
Local Authentication Example	185
TACACS+ Authentication Example	186
RADIUS Authentication Example	188
Authorization Examples	189
Local Authorization Example—Direct Login to Privileged EXEC Mode	189
TACACS+ Authorization Example—Direct Login to Privileged EXEC Mode	189
TACACS+ Authorization Example—Administrative Profiles	190
TACACS+ Authorization Example—Custom Administrative Profile	191
TACACS+ Authorization Example—Per-command Authorization	192
RADIUS Authorization Example—Direct Login to Privileged EXEC Mode	193
RADIUS Authorization Example—Administrative Profiles	193
Using RADIUS Servers to Control Management Access	194
How Does RADIUS Control Management Access?	194
Which RADIUS Attributes Does the Switch Support?	196
How Are RADIUS Attributes Processed on the Switch?	198
Using TACACS+ Servers to Control Management Access	199
Which TACACS+ Attributes Does the Switch Support?	200
Default Configurations	201
Method Lists	201
Access Lines (AAA)	201
Access Lines (Non-AAA)	202
Administrative Profiles	202
Monitoring and Logging System Information	205
System Monitoring Overview	205
What System Information Is Monitored?	205
Why Is System Information Needed?	206
Where Are Log Messages Sent?	206
What Are the Severity Levels?	207
What Are the System Startup and Operation Logs?	207
What Is the Log Message Format?	208
What Factors Should Be Considered When Configuring Logging?	209
Default Log Settings	209
Monitoring System Information and Configuring Logging (Web)	210
Device Information	210
System Health	211
System Resources	212
Integrated Cable Test for Copper Cables	213
Optical Transceiver Diagnostics	214
Log Global Settings	216
RAM Log	217
Log File	218
Remote Log Server	218
Email Alert Global Configuration	221
Email Alert Mail Server Configuration	222
Email Alert Subject Configuration	224
Email Alert To Address Configuration	225
Email Alert Statistics	226
Monitoring System Information and Configuring Logging (CLI)	227
Viewing System Information	227
Running Cable Diagnostics	227
Configuring Local Logging	228
Configuring Remote Logging	230
Configuring Mail Server Settings	231
Configuring Email Alerts for Log Messages	232
Logging Configuration Examples	234
Configuring Local and Remote Logging	234
Configuring Email Alerting	235
Managing General System Settings	239
System Settings Overview	239
Why Does System Information Need to Be Configured?	240
What Are SDM Templates?	241
Why is the System Time Needed?	242
How Does SNTP Work?	242
Default General System Information	242
Configuring General System Settings (Web)	243
System Information	243
CLI Banner	246
SDM Template Preference	247
Clock	248
SNTP Global Settings	249
SNTP Authentication	250
SNTP Server	252
Summer Time Configuration	256
Time Zone Configuration	257
Slot Summary	258
Supported Cards	259
Configuring System Settings (CLI)	260
Configuring System Information	260
Configuring the Banner	261
Managing the SDM Template	262
Configuring SNTP Authentication and an SNTP Server	262
Setting the System Time and Date Manually	264
Viewing Slot Information	265
General System Settings Configuration Examples	266
Configuring System and Banner Information	266
Configuring SNTP	269
Configuring the Time Manually	271
Configuring SNMP	273
SNMP Overview	273
What Is SNMP?	273
What Are SNMP Traps?	274
Why Is SNMP Needed?	275
Default SNMP Values	275
Configuring SNMP (Web)	277
SNMP Global Parameters	277
SNMP View Settings	278
Access Control Group	280
SNMPv3 User Security Model (USM)	282
Communities	285
Notification Filter	287
Notification Recipients	288
Trap Flags	291
OSPFv2 Trap Flags	292
OSPFv3 Trap Flags	293
Trap Log	294
Configuring SNMP (CLI)	295
Configuring the SNMPv3 Engine ID	295
Configuring SNMP Views, Groups, and Users	296
Configuring Communities	299
Configuring SNMP Notifications (Traps and Informs)	301
SNMP Configuration Examples	304
Configuring SNMPv1 and SNMPv2	304
Configuring SNMPv3	305
Managing Images and Files	309
Image and File Management Overview	309
What Files Can Be Managed?	309
Why Is File Management Needed?	311
What Methods Are Supported for File Management?	313
What Factors Should Be Considered When Managing Files?	313
How Is the Running Configuration Saved?	315
Managing Images and Files (Web)	316
File System	316
Active Images	317
USB Flash Drive	318
File Download	319
File Upload	321
Copy Files	323
Managing Images and Files (CLI)	324
Downloading and Activating a New Image (TFTP)	324
Managing Files in Internal Flash	326
Managing Files on a USB Flash Device (PowerConnect 8100-series switches only)	327
Uploading a Configuration File (SCP)	327
Managing Configuration Scripts (SFTP)	328
File and Image Management Configuration Examples	329
Upgrading the Firmware	329
Managing Configuration Scripts	332
Managing Files by Using the USB Flash Drive (PowerConnect 8100- series switches only)	334
Automatically Updating the Image and Configuration	337
Auto Configuration Overview	337
What Is USB Auto Configuration?	338
What Files Does USB Auto Configuration Use?	338
How Does USB Auto Configuration Use the Files on the USB Device?	340
What Is the Setup File Format?	341
What Is the DHCP Auto Configuration Process?	342
Monitoring and Completing the DHCP Auto Configuration Process	347
What Are the Dependencies for DHCP Auto Configuration?	348
Default Auto Configuration Values	349
Managing Auto Configuration (Web)	350
Auto-Install Configuration	350
Managing Auto Configuration (CLI)	351
Managing Auto Configuration	351
Auto Configuration Example	352
Enabling DHCP Auto Configuration and Auto Image Download	352
Monitoring Switch Traffic	355
Traffic Monitoring Overview	355
What is sFlow Technology?	355
What is RMON?	358
What is Port Mirroring?	359
Why is Traffic Monitoring Needed?	360
Default Traffic Monitoring Values	360
Monitoring Switch Traffic (Web)	361
sFlow Agent Summary	361
sFlow Receiver Configuration	362
sFlow Sampler Configuration	363
sFlow Poll Configuration	364
Interface Statistics	365
Etherlike Statistics	366
GVRP Statistics	367
EAP Statistics	368
Utilization Summary	369
Counter Summary	370
Switchport Statistics	371
RMON Statistics	372
RMON History Control Statistics	373
RMON History Table	375
RMON Event Control	376
RMON Event Log	378
RMON Alarms	379
Port Statistics	381
LAG Statistics	382
Port Mirroring	383
Monitoring Switch Traffic (CLI)	386
Configuring sFlow	386
Configuring RMON	388
Viewing Statistics	390
Configuring Port Mirroring	391
Traffic Monitoring Configuration Examples	392
Configuring sFlow	392
Configuring RMON	394
Configuring iSCSI Optimization	395
iSCSI Optimization Overview	395
What Does iSCSI Optimization Do?	396
How Does the Switch Detect iSCSI Traffic Flows?	396
How Is Quality of Service Applied to iSCSI Traffic Flows?	396
How Does iSCSI Optimization Use ACLs?	397
What Information Does the Switch Track in iSCSI Traffic Flows?	398
How Does iSCSI Optimization Interact With Dell EqualLogic Arrays?	399
What Occurs When iSCSI Optimization Is Enabled or Disabled?	399
How Does iSCSI Optimization Interact with DCBx?	400
How Does iSCSI Optimization Interact with Dell Compellent Arrays?	400
iSCSI CoS and Priority Flow Control/Enhanced Transmission Selection Interactions	401
Default iSCSI Optimization Values	402
Configuring iSCSI Optimization (Web)	403
iSCSI Global Configuration	403
iSCSI Targets Table	404
iSCSI Sessions Table	405
iSCSI Sessions Detailed	406
Configuring iSCSI Optimization (CLI)	407
iSCSI Optimization Configuration Examples	409
Configuring iSCSI Optimization Between Servers and a Disk Array	409
Configuring Captive Portal	413
Captive Portal Overview	413
What Does Captive Portal Do?	413
Is the Captive Portal Feature Dependent on Any Other Feature?	414
What Factors Should Be Considered When Designing and Configuring a Captive Portal?	415
How Does Captive Portal Work?	416
What Captive Portal Pages Can Be Customized?	417
Default Captive Portal Behavior and Settings	418
Configuring the Captive Portal (Web)	420
Captive Portal Global Configuration	420
Captive Portal Configuration	421
Local User	426
User Group	430
Interface Association	432
Captive Portal Global Status	433
Captive Portal Activation and Activity Status	434
Interface Activation Status	435
Interface Capability Status	436
Client Summary	437
Client Detail	438
Captive Portal Interface Client Status	439
Captive Portal Client Status	440
Configuring Captive Portal (CLI)	441
Configuring Global Captive Portal Settings	441
Creating and Configuring a Captive Portal	442
Configuring Captive Portal Groups and Users	445
Managing Captive Portal Clients	446
Captive Portal Configuration Example	447
Configuration Overview	448
Detailed Configuration Procedures	449
Configuring Port Characteristics	451
Port Overview	451
What Physical Port Characteristics Can Be Configured?	451
What is Link Dependency?	452
What Interface Types are Supported?	454
What is Interface Configuration Mode?	454
Default Port Values	456
Configuring Port Characteristics (Web)	457
Port Configuration	457
Link Dependency Configuration	460
Link Dependency Summary	462
Configuring Port Characteristics (CLI)	463
Configuring Port Settings	463
Configuring Link Dependencies	464
Port Configuration Examples	466
Configuring Port Settings	466
Configuring a Link Dependency Groups	467
Configuring Port and System Security	469
IEEE 802.1X	470
What is IEEE 802.1X?	470
What are the 802.1X Port States?	471
What is MAC-Based 802.1X Authentication?	472
What is the Role of 802.1X in VLAN Assignment?	473
What is Monitor Mode?	475
How Does the Authentication Server Assign DiffServ Filters?	477

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234
1,235
1,236
1,237
1,238
1,239
1,240
1,241
1,242
1,243
1,244
1,245
1,246
1,247
1,248
1,249
1,250
1,251
1,252
1,253
1,254
1,255
1,256
1,257
1,258
1,259
1,260
1,261
1,262
1,263
1,264
1,265
1,266
1,267
1,268
1,269
1,270
1,271
1,272
1,273
1,274
1,275
1,276
1,277
1,278
1,279
1,280
1,281
1,282
1,283
1,284
1,285
1,286
1,287
1,288
1,289
1,290
1,291
1,292
1,293
1,294

Match case Limit results 1 per page

504

Configuring Port and System Security

•

The RADIUS or 802.1X server must specify the policy to assign.

For example, if the DiffServ policy to assign is named internet_access,

include the following attribute in the RADIUS or 802.1X server

configuration:

Filter-id = “internet_access”

•

The DiffServ policy specified in the attribute must already be configured

on the switch, and the policy names must be identical.

For information about configuring a DiffServ policy, see "DiffServ

Configuration Examples" on page 1136. The example "Providing Subnets

Equal Access to External Network" on page 1136, describes how to

configure a policy named internet_access.

If you use an authentication server to assign DiffServ policies to an

authenticated user, note the following guidelines:

•

If the policy specified within the server attribute does not exist on the

switch, authentication will fail.

•

Do not delete policies used as the filter ID in the RADIUS server while

802.1X is enabled.

•

Do not use the DiffServ

service-policy

command to apply the filter to an

interface if you configure the RADIUS server or 802.1X authenticator to

assign the DiffServ filter.

In the following example, Company XYZ uses IEEE 802.1X to authenticate

all users. Contractors and temporary employees at Company XYZ are not

permitted to have access to SSH ports, and data rates for Web traffic is

limited. When a contractor is authenticated by the RADIUS server, the server

assigns a DiffServ policy to control the traffic restrictions.

The network administrator configures two DiffServ classes:

cl-ssh

and

cl-http

The class

cl-ssh

matches all incoming SSH packets. The class

cl-http

matches

all incoming HTTP packets. Then, the administrator configures a traffic

policy called

con-pol

and adds the

cl-ssh

and

cl-http

. The policy is configured

so that that SSH packets are to be dropped, and HTTP data rates are limited

to 1 MB with a burst size of 64 Kbps. HTTP traffic that exceeds the limit is

dropped.

The host ports, ports 1–23, are configured to use MAC-based dot1X

authentication to allow the DiffServ policy to be applied. Finally,

the

administrator configures the RADIUS server with the attribute

Filter-id =

“con-pol”.