Home » Dell Manuals » Hubs & Switches » Dell PowerConnect B-RX » Manual Viewer

Dell PowerConnect B-RX BigIron RX Series Configuration Guide v02.8.00 - Page 1042

Message exchange during authentication, Authentication Server. Refer

View all Dell PowerConnect B-RX manuals

Add to My Manuals
Save this manual to your list of manuals

Page 1042 highlights

33 How 802.1x port security works FIGURE 126 Controlled and uncontrolled ports before and after client authentication Authentication Server Authentication Server BigIron Device (Authenticator) PAE Uncontrolled Port Services Controlled Port (Unauthorized) Physical Port PAE Services BigIron Device (Authenticator) Uncontrolled Port Controlled Port (Authorized) Physical Port PAE PAE 802.1X-Enabled Supplicant 802.1X-Enabled Supplicant Before Authentication After Authentication Before a Client is authenticated, only the uncontrolled port on the Authenticator is open. The uncontrolled port allows only EAPOL frames to be exchanged between the Client and the Authentication Server. The controlled port is in the unauthorized state and allows no traffic to pass through. During authentication, EAPOL messages are exchanged between the Supplicant PAE and the Authenticator PAE, and RADIUS messages are exchanged between the Authenticator PAE and the Authentication Server. Refer to "Message exchange during authentication" on page 966 for an example of this process. If the Client is successfully authenticated, the controlled port becomes authorized, and traffic from the Client can flow through the port normally. By default, all controlled ports on the BigIron RX are placed in the authorized state, allowing all traffic. When authentication is activated on an 802.1x-enabled interface, the interface's controlled port is placed initially in the unauthorized state. When a Client connected to the port is successfully authenticated, the controlled port is then placed in the authorized state until the Client logs off. Refer to "Enabling 802.1x port security" on page 976 for more information. Message exchange during authentication Figure 127 illustrates a sample exchange of messages between an 802.1x-enabled Client, a BigIron RX acting as Authenticator, and a RADIUS server acting as an Authentication Server. 966 BigIron RX Series Configuration Guide 53-1002253-01

Section	Page
Contents	3
About This Document	41
Audience	41
Supported hardware and software	41
List of supported features	41
Unsupported features	44
What’s new in this document	45
Enhancements in release 02.8.00	46
Enhancements in release 02.7.03	47
Enhancements in release 02.7.02	48
Enhancements in release 02.7.00	50
Enhancements in release 02.6.00	51
Enhancements in patch release 02.5.00c	54
Enhancements in patch release 02.5.00b	55
Enhancements in release 02.5.00	55
Enhancements in patch release 02.4.00c	57
Enhancements in release 02.4.00	58
Enhancements in patch release 02.3.00a	62
Enhancements in release 02.3.00	63
Enhancements in release 02.2.01	69
Enhancements in release 02.2.00g	73
Enhancements in release 02.2.00	73
Document conventions	74
Text formatting	74
Command syntax conventions	74
Notes, cautions, and danger notices	75
Notice to the reader	75
Related publications	75
Getting technical help or reporting errors	76
E-mail and telephone access	76
Getting Started with the Command Line Interface	77
In this chapter	77
Logging on through the CLI	77
On-line help	78
Command completion	78
Scroll control	78
Line editing commands	79
EXEC commands	79
Global level	80
CONFIG commands	80
Accessing the CLI	83
Navigating among command levels	84
CLI command structure	84
Searching and filtering output	85
Allowable characters for LAG names	89
Syntax shortcuts	90
Saving configuration changes	90
Getting Familiar With the BigIron RX Series Switch Management Applications	91
How to manage BigIron RX Series switch	91
Logging on through the CLI	91
On-line help	92
Command completion	92
Scroll control	92
Line editing commands	93
Searching and filtering output from CLI commands	93
Allowable characters for LAG names	97
Logging on through the Web Management Interface	98
Web Management Interface	99
Using a Redundant Management Module	101
How management module redundancy works	101
Management module redundancy overview	101
Management module switchover	102
Switchover implications	103
Management module redundancy configuration	105
Changing the default active slot	105
Managing management module redundancy	105
File synchronization between the active and standby management modules	105
Manually switching over to the standby management module	108
Rebooting the active and standby management modules	108
Monitoring management module redundancy	109
Determining management module status	109
Displaying temperature information	110
Displaying switchover information	110
Flash memory and PCMCIA flash card file management commands	112
Management focus	113
Flash memory file system	114
PCMCIA flash card file system	115
Wildcards	116
Formatting a flash card	116
Determining the current management focus	117
Switching the management focus	117
Displaying a directory of the files	118
Displaying the contents of a file	120
Displaying the hexadecimal output of a file	121
Creating a subdirectory	121
Removing a subdirectory	123
Renaming a file	124
Changing the read-write attribute of a file	124
Deleting a file	125
Recovering (“undeleting”) a file	126
Appending a file to another file	127
Copying files using the copy command	127
Copying files using the cp command	132
Loading the software	133
Saving configuration changes	134
File management messages	135
Securing Access to Management Functions	137
Securing access methods	137
Restricting remote access to management functions	139
Using ACLs to restrict remote access	139
Restricting remote access to the device to specific IP addresses	142
Specifying the maximum number of login attempts for Telnet access	143
Restricting remote access to the device to specific VLAN IDs	144
Disabling specific access methods	145
Setting passwords	146
Setting a Telnet password	147
Setting passwords for management privilege levels	147
Recovering from a lost password	149
Displaying the SNMP community string	150
Disabling password encryption	150
Specifying a minimum password length	150
Setting up local user accounts	150
Configuring a local user account	151
Username, password and login rules	153
Configuring the strict password feature	154
Configuring SSL security for the Web Management Interface	157
Enabling the SSL server on the device	157
Importing digital certificates and RSA private key files	157
Generating an SSL certificate	158
Configuring TACACS and TACACS+ security	158
How TACACS+ differs from TACACS	159
TACACS and TACACS+ authentication, authorization, and accounting	159
TACACS and TACACS+ configuration considerations	162
Enabling SNMP to configure TACACS and TACACS	163
Identifying the TACACS and TACACS+ servers	164
Specifying different servers for individual AAA functions	164
Setting optional TACACS and TACACS+ parameters	165
Configuring authentication-method lists for TACACS and TACACS+	166
Configuring TACACS+ authorization	168
Configuring TACACS+ accounting	171
Configuring an interface as the source for all TACACS and TACACS+ packets	172
Displaying TACACS and TACACS+ statistics and configuration information	173
Configuring RADIUS security	174
RADIUS authentication, authorization, and accounting	174
RADIUS configuration considerations	177
RADIUS configuration procedure	178
Configuring Brocade-specific attributes on the RADIUS server	178
Enabling SNMP to configure RADIUS	179
Identifying the RADIUS server to the BigIron RX	180
Specifying different servers for individual AAA functions	180
Setting RADIUS parameters	180
Configuring authentication-method lists for RADIUS	181
Configuring RADIUS authorization	183
Configuring RADIUS accounting	185
Configuring an interface as the source for all RADIUS packets	186
Displaying RADIUS configuration information	186
Configuring authentication-method lists	188
Configuration considerations for authentication- method lists	189
Examples of authentication-method lists	189
Configuring Basic Parameters	193
Entering system administration information	193
Configuring Simple Network Management Protocol traps	194
Specifying an SNMP trap receiver	194
Specifying a Single trap source	195
Setting the SNMP Trap holddown time	195
Disabling SNMP traps	196
Disabling Syslog messages and traps for CLI access	197
Configuring an interface as source for all Telnet packets	198
Cancelling an outbound Telnet session	199
Configuring an interface as the source for all TFTP packets	199
Configuring an interface as the source for Syslog packets	199
Specifying a Simple Network Time Protocol (SNTP) server	200
Setting the system clock	202
New Daylight Saving Time (DST)	203
Configuring CLI banners	203
Setting a message of the day banner	204
Setting a privileged EXEC CLI level banner	204
Displaying a message on the console when an incoming Telnet session is detected	205
Configuring terminal display	205
Checking the length of terminal displays	205
Enabling or disabling routing protocols	206
Displaying and modifying system parameter default settings	206
Enabling or disabling Layer 2 switching	209
CAM partitioning for the BigIron RX	210
Re-distributing CAM allocations	210
Nexthop table	211
Changing the MAC age time	212
Configuring static ARP entries	212
Pinging an IPv4 address	213
Configuring Interface Parameters	215
Assigning a port name	215
Assigning an IP address to a port	215
Speed/Duplex negotiation	216
Disabling or re-enabling a port	217
Changing the default Gigabit negotiation mode	217
Changing the negotiation mode	218
Disabling or re-enabling flow control	218
Specifying threshold values for flow control	218
Locking a port to restrict addresses	219
Wait for all cards feature	219
Port transition hold timer	220
Port flap dampening	220
Modifying port priority (QoS)	222
Assigning a mirror port and monitor ports	222
Configuration guidelines for monitoring traffic	222
Configuring port mirroring and monitoring	222
Monitoring an individual trunk port	224
Mirror ports for Policy-Based Routing (PBR) traffic	225
About hardware-based PBR	225
Configuring mirror ports for PBR traffic	226
Displaying mirror and monitor port configuration	226
Enabling WAN PHY mode support	227
Configuring IP	229
Overview of configuring IP	229
The IP packet flow	229
ARP cache table	230
Static ARP table	230
IP Route table	231
IP forwarding cache	232
Basic IP parameters and defaults	232
When parameter changes take effect	233
IP global parameters	233
IP interface parameters	236
Configuring IP parameters	237
Configuring IP addresses	237
Changing the network mask display to prefix format	240
Configuring the default gateway	240
GRE IP tunnel	241
IPv6 over IPv4 tunnels in hardware	246
Configuring Domain Name Server (DNS) resolver	250
Adding host names to the DNS cache table	251
Configuring packet parameters	255
Changing the encapsulation type	255
Setting maximum frame size per PPCR	256
Changing the MTU	257
Changing the router ID	258
Specifying a single source interface for Telnet, TACACS, TACACS+, or RADIUS packets	259
Configuring an interface as the source for Syslog packets	261
IP fragmentation protection	261
IP option attack protection	262
IP receive access list	262
Configuring ARP parameters	263
How ARP works	263
Rate limiting ARP packets	264
Applying a rate limit to ARP packets on an interface	264
Clearing the rate limit for ARP packets	266
Changing the ARP aging period	266
Creating a floating static ARP entry	268
Static route ARP validation check	268
Configuring forwarding parameters	270
Disabling ICMP messages	272
Disabling ICMP redirect messages	274
Configuring static routes	274
Static route tagging	279
Configuring a default network route	284
Configuring IP load sharing	285
Default route ECMP	288
IP receive access list	289
Configuring IRDP	290
Configuring UDP broadcast and IP helper parameters	292
Configuring BootP/DHCP forwarding parameters	294
Displaying IP information	296
Displaying IP interface information	299
Displaying interface name in Syslog	300
Displaying ARP entries	300
Displaying the forwarding cache	302
Displaying the IP route table	304
Clearing IP routes	307
Displaying IP traffic statistics	307
Displaying TCP traffic statistics	310
Link Aggregation	313
Link aggregation overview	313
LAG formation rules	313
LAG load sharing	316
Configuration of a LAG	317
Creating a Link Aggregation Group (LAG)	317
Deploying a LAG	320
Commands available under LAG once it is deployed	320
Configuring ACL-based mirroring	321
Disabling ports within a LAG	321
Enabling ports within a LAG	321
Monitoring an individual LAG port	322
Assigning a name to a port within a LAG	322
Enabling sFlow forwarding on a port within a LAG	322
Setting the sFlow sampling rate for a port within a LAG	323
Displaying LAG information	323
Displaying LAG statistics	327
Configuring LLDP	329
Terms used in this chapter	329
LLDP overview	329
Benefits of LLDP	330
General operating principles	331
Operating modes	331
LLDP packets	331
TLV support	332
MIB support	335
Syslog messages	335
Web Management	335
Configuring LLDP	335
Configuration notes and considerations	336
Enabling and disabling LLDP	337
Changing a port’s LLDP operating mode	337
Specifying the maximum number of LLDP neighbors	338
Enabling LLDP SNMP notifications and Syslog messages	339
Specifying the minimum time between SNMP traps and Syslog messages	340
Changing the minimum time between LLDP transmissions	340
Changing the interval between regular LLDP transmissions	341
Changing the holdtime multiplier for transmit TTL	341
Changing the minimum time between port reinitializations	342
LLDP TLVs advertised by the Brocade device	342
Displaying LLDP statistics and configuration settings	349
LLDP configuration summary	350
LLDP statistics	350
LLDP neighbors	352
LLDP neighbors detail	353
LLDP configuration details	354
Resetting LLDP statistics	355
Configuring Uni-Directional Link Detection (UDLD)	357
Configuration considerations	358
Configuring UDLD	358
Changing the keepalive interval	358
Changing the keepalive retries	358
Displaying UDLD information	359
Displaying information for all ports	359
Displaying link-keepalive information	359
Displaying information for a single port	360
Clearing UDLD statistics	362
VLANs	363
Overview of Virtual Local Area Networks (VLANs)	363
Tagged, untagged, and dual-mode ports	363
Protocol-based VLANs	365
VLAN configuration rules	366
VLAN ID range	366
Tagged VLANs	366
VLAN hierarchy	366
Multiple VLAN membership rules	366
Layer 2 control protocols on VLANs	367
Configuring port-based VLANs	367
VLAN byte accounting	368
Strictly or explicitly tagging a port	370
Assigning or changing a VLAN priority	370
Assigning a different ID to the default VLAN	370
Configuring protocol-based VLANs	371
Configuring an MSTP instance	372
Configuring virtual routing interfaces	372
Bridging and routing the same protocol simultaneously on the same device	373
Integrated Switch Routing (ISR)	374
VLAN groups	375
Configuring a VLAN group	375
Configuring super aggregated VLANs	377
Configuring aggregated VLANs	379
Complete CLI examples	380
Configuring 802.1q-in-q tagging	383
Configuration rules	384
Enabling 802.1Q-in-Q tagging	385
Example configuration	385
Configuring 802.1q tag-type translation	386
Configuration rules	388
Enabling 802.1q tag-type translation	389
Private VLANs	390
Implementation notes	391
Configuration notes	391
Configuring a private VLAN	392
Enabling broadcast, multicast or unknown unicast traffic to the private VLAN	394
CLI example for Figure 30	394
Other VLAN features	395
Allocating memory for more VLANs or virtual routing interfaces	395
Hardware flooding for Layer 2 multicast and broadcast packets	395
Unknown unicast flooding on VLAN ports	396
Flow based MAC learning	396
Configuring uplink ports within a port-based VLAN	397
Configuring control protocols in VLANs	397
Other configuration options	397
Displaying VLAN information	397
Displaying VLAN information	398
Displaying VLAN information for specific ports	398
Displaying VLAN status and port types	399
Displaying VLAN group information	400
Transparent firewall mode	401
Enabling a transparent firewall	401
Configuring Spanning Tree Protocol	403
IEEE 802.1D Spanning Tree Protocol (STP)	403
Enabling or disabling STP	403
Default STP bridge and port parameters	404
Changing STP bridge parameters	405
Changing STP port parameters	406
STP root guard	406
Spanning Tree Protocol (STP) BPDU guard	407
Displaying STP information	408
IEEE Single Spanning Tree (SSTP)	416
SSTP defaults	417
Enabling SSTP	417
Displaying SSTP information	418
PVST/PVST+ compatibility	419
Overview of PVST and PVST+	419
VLAN tags and dual mode	419
Enabling PVST+ support	420
Displaying PVST+ support information	420
Configuration examples	421
SuperSpan™	423
Customer ID	424
BPDU forwarding	424
Configuring SuperSpan	429
Configuring Rapid Spanning Tree Protocol	433
Overview of Rapid Spanning Tree Protocol	433
Bridges and bridge port roles	433
Assignment of port roles	434
Ports on Switch 1	435
Ports on Switch 2	435
Ports on Switch 3	435
Ports Switch 4	436
Edge ports and edge port roles	436
Point-to-point ports	437
Bridge port states	437
Edge port and non-edge port states	438
Changes to port roles and states	438
State machines	438
Handshake mechanisms	439
Convergence in a simple topology	449
Convergence at start up	450
Convergence after a link failure	452
Convergence at link restoration	453
Convergence in a complex RSTP topology	454
Propagation of topology change	457
Compatibility of RSTP with 802.1D	460
Configuring RSTP parameters	461
Enabling or disabling RSTP in a port-based VLAN	461
Enabling or disabling RSTP on a single spanning tree	462
Disabling or enabling RSTP on a port	462
Changing RSTP bridge parameters	462
Changing port parameters	463
Fast port span	464
Fast uplink span	466
Displaying RSTP information	468
Metro Ring Protocol (MRP) Phase 1 and 2	477
Metro Ring Protocol (MRP) phase 1	477
MRP rings without shared interfaces	478
Ring initialization	479
How ring breaks are detected and healed	482
Master VLANs and customer VLANs in a topology group	484
Configuring MRP	486
Adding an MRP ring to a VLAN	487
Changing the hello and preforwarding times	488
MRP phase 2	488
Ring initialization for shared interfaces	490
How ring breaks are detected and healed between shared interfaces	490
Selection of master node	491
RHP processing in rings with shared interfaces	491
Normal flow	492
Flow when a link breaks	493
Configuring MRP with shared interfaces	493
Using MRP diagnostics	494
Enabling MRP diagnostics	494
Displaying MRP diagnostics	495
Displaying MRP information	495
Displaying topology group information	495
Displaying ring information	496
MRP CLI example	497
Commands on switch A (master node)	498
Commands on switch B	498
Commands on switch C	499
Commands on switch D	499
Virtual Switch Redundancy Protocol (VSRP)	501
Overview of Virtual Switch Redundancy Protocol (VSRP)	501
Layer 2 and Layer 3 redundancy	502
Master election and failover	502
Configuring basic VSRP parameters	507
Enabling Layer 3 VSRP	508
Configuring optional VSRP parameters	508
Disabling VSRP on a VRID	508
Configuring authentication	508
Configuring a VRID IP address	509
VSRP fast start	510
Changing the backup priority	511
Saving the timer values received from the master	511
VSRP slow start	512
Changing the Time-To-Live (TTL)	512
Changing the hello interval	513
Changing the dead interval	513
Changing the backup hello state and interval	513
Changing the hold-down interval	514
Changing the default track priority	514
Specifying a track port	515
Disabling or re-enabling backup pre-emption	515
Port transition hold timer	515
Clearing VSRP information	516
VSRP and MRP signaling	516
Displaying VSRP information	518
Displaying VRID information	518
Displaying a summary of VSRP information	520
Displaying VSRP packet statistics for VSRP	521
Displaying the active interfaces for a VRID	522
Topology Groups	523
Topology overview	523
Master VLAN and member VLANs	523
Master VLANs and customer VLANs in MRP	524
Control ports and free ports	524
Configuration considerations	524
Configuring a topology group	525
Displaying topology group information	525
Displaying topology group information	525
Configuring VRRP and VRRPE	527
Overview of VRRP	527
Standard VRRP	527
Brocade enhancements of VRRP	529
Overview of VRRPE	531
VRRP and VRRPE parameters	534
Configuring parameters specific to VRRP	536
Configuring the owner	536
Configuring basic VRRP parameters	536