Home » Dell Manuals » Hubs & Switches » Dell PowerConnect W-7200 Series » Manual Viewer

Dell PowerConnect W-7200 Series ArubaOS 6.2 User Guide - Page 201

Dell PowerConnect W-7200 Series Manual

View all Dell PowerConnect W-7200 Series manuals

Add to My Manuals
Save this manual to your list of manuals

Page 201 highlights

server-cert ca-cert Configuring User and Machine Authentication When a Windows device boots, it logs onto the network domain using a machine account. Within the domain, the device is authenticated before computer group policies and software settings can be executed; this process is known as machine authentication. Machine authentication ensures that only authorized devices are allowed on the network. You can configure 802.1x for both user and machine authentication (select the Enforce Machine Authentication option described in Table 61). This tightens the authentication process further since both the device and user need to be authenticated. Working with Role Assignment with Machine Authentication Enabled When you enable machine authentication, there are two additional roles you can define in the 802.1x authentication profile: l l Machine authentication default machine role Machine authentication default user role While you can select the same role for both options, you should define the roles as per the polices that need to be enforced. Also, these roles can be different from the 802.1x authentication default role configured in the AAA profile. With machine authentication enabled, the assigned role depends upon the success or failure of the machine and user authentications. In certain cases, the role that is ultimately assigned to a client can also depend upon attributes returned by the authentication server or server derivation rules configured on the controller. Table 62 describes role assignment based on the results of the machine and user authentications. Table 62: Role Assignment for User and Machine Authentication Machine Auth Status Failed User Auth Status Failed Description Both machine authentication and user authentication failed. L2 authentication failed. Machine authentication fails (for example, the machine information is not present on the server) and user authentication succeeds. Server-derived roles do not apply. Machine authentication succeeds and user authentication has not been initiated. Serverderived roles do not apply. Both machine and user are successfully authenticated. If there are server-derived roles, the role assigned via the derivation take precedence. This is the only case where server-derived roles are applied. Role Assigned No role assigned. No access to the network allowed. Failed Passed Machine authentication default user role configured in the 802.1x authentication profile. Passed Failed Machine authentication default machine role configured in the 802.1x authentication profile. A role derived from the authentication server takes precedence. Otherwise, the 802.1x authentication default role configured in the AAA profile is assigned. Passed Passed For example, if the following roles are configured: l l 802.1x authentication default role (in AAA profile): dot1x_user Machine authentication default machine role (in 802.1x authentication profile): dot1x_mc 201 | 802.1X Authentication Dell PowerConnect W-Series ArubaOS 6.2 | User Guide

Section	Page
Copyright Information	2
Open Source Code	2
Legal Notice	2
Contents	3
About this Guide	61
What’s New In ArubaOS 6.2	61
Fundamentals	63
WebUI	63
CLI	63
Related Documents	64
Conventions	64
The Basic User-Centric Networks	66
Understanding Basic Deployment and Configuration Tasks	66
Deployment Scenario #1: Controller and APs on Same Subnet	66
Deployment Scenario #2: APs All on One Subnet Different from Controller Subnet	67
Deployment Scenario #3: APs on Multiple Different Subnets from Controllers	68
Configuring the Controller	69
Running Initial Setup	69
Connecting to the Controller after Initial Setup	70
Dell W-7200 Series Controller	70
New Port Numbering Scheme	70
Individual Port Behavior	70
Using the LCD Screen	70
Using the LCD and USB Drive	72
Upgrading an Image	72
Uploading a Pre-saved Configuration	72
Disabling LCD Menu Functions	73
Configuring a VLAN to Connect to the Network	73
Creating, Updating, and Viewing VLANs and Associated IDs	74
Creating, Updating, and Deleting VLAN Pools	74
Assigning and Configuring the Trunk Port	74
In the WebUI	75
In the CLI	75
Configuring the Default Gateway	75
In the WebUI	75
In the CLI	75
Configuring the Loopback IP Address for the Controller	75
In the WebUI	76
In the CLI	76
Configuring the System Clock	76
Installing Licenses	77
Connecting the Controller to the Network	77
Enabling Wireless Connectivity	77
Configuring Your User-Centric Network	77
Control Plane Security	79
Control Plane Security Overview	80
Configuring Control Plane Security	80
In the WebUI	80
In the CLI	81
Managing AP Whitelists	82
Adding APs to the Campus and Remote AP Whitelists	82
Viewing Whitelist Status	83
Modifying an AP in the Campus AP Whitelist	85
Revoking an AP via the Campus AP Whitelist	86
Deleting an AP Entry from the Campus AP Whitelist	86
Purging the Campus AP Whitelist	86
Managing Whitelists on Master and Local Controllers	87
Campus AP Whitelist Synchronization	88
Viewing and Managing the Master or Local Switch Whitelists	88
Viewing the Master or Local Switch Whitelist	88
Deleting an Entry from the Master or Local Switch Whitelist	89
Purging the Master or Local Switch Whitelist	90
Working in Environments with Multiple Master Controllers	90
Configuring Networks with a Backup Master Controller	90
Configuring Networks with Clusters of Master Controllers	90
Creating a Cluster Root	91
Creating a Cluster Member	92
Viewing Controller Cluster Settings	92
Replacing a Controller on a Multi-Controller Network	93
Replacing Controllers in a Single Master Network	93
Replacing a Local Controller	93
Replacing a Master Controllerwith No Backup	94
Replacing a Redundant Master Controller	94
Replacing Controllers in a Multi-Master Network	95
Replacing a Local Controller in a Multi-Master Network	95
Replacing a Cluster Member Controller with no Backup	95
Replacing a Redundant Cluster Member Controller	95
Replacing a Cluster Root Controller with no Backup Controller	96
Replacing a Redundant Cluster Root Controller	96
Configuring Control Plane Security after Upgrading	97
Troubleshooting Control Plane Security	97
Identifying Certificate Problems	97
Verifying Certificates	98
Disabling Control Plane Security	98
Verifying Whitelist Synchronization	98
Supported APs	99
Rogue APs	99
Software Licenses	100
Understanding License Terminology	100
Working with Licenses	101
Working with Licenses on a Multiple Controller Network	102
Using Licenses	102
Understanding License Interaction	103
License Installation Best Practices and Exceptions	104
Installing a License	104
Enabling a new license on your controller	104
Requesting a Software License in Email	105
Locating the System Serial Number	105
Obtaining a Software License Key	105
Creating a Software License Key	105
Applying the Software License Key in the WebUI	106
Applying the Software License Key in the License Wizard	106
Deleting a License	106
Moving Licenses	106
Resetting the Controller	106
Network Configuration Parameters	108
Configuring VLANs	108
Creating and Updating VLANs	108
In the WebUI	108
In the CLI	109
Creating Bulk VLANs In the WebUI	109
In the CLI	109
Creating Named VLANs	109
Creating a Named VLAN not in a Pool	109
In the WebUI	109
In the CLI	110
Creating a VLAN Pool	110
Using the WebUI	110
Distinguishing Between Even and Hash Assignment Types	111
Updating a VLAN Pool	112
Deleting a VLAN Pool	112
Creating a VLAN Pool Using the CLI	112
Viewing and Adding VLAN IDs Using the CLI	112
Adding a Bandwidth Contract to the VLAN	113
Optimizing VLAN Broadcast and Multicast Traffic	113
Using the CLI	114
Using the WebUI	114
Configuring Ports	114
Classifying Traffic as Trusted or Untrusted	115
About Trusted and Untrusted Physical Ports	115
About Trusted and Untrusted VLANs	115
Configuring Trusted/Untrusted Ports and VLANs	115
In the WebUI	115
In the CLI	116
Configuring Trusted and Untrusted Ports and VLANs in Trunk Mode	116
In the WebUI	116
In the CLI	117
Understanding VLAN Assignments	117
How a VLAN Obtains an IP Address	117
Assigning a Static Address to a VLAN	117
In the WebUI	118
In the CLI	118
Configuring a VLAN to Receive a Dynamic Address	118
Configuring Multiple Wired Uplink Interfaces (Active-Standby)	118
Enabling the DHCP Client	118
In the WebUI	118
In the CLI	119
Enabling the PPPoE Client	119
In the WebUI	119
In the CLI	120
Default Gateway from DHCP/PPPoE	120
In the WebUI	120
In the CLI	120
Configuring DNS/WINS Server from DHPC/PPPoE	120
In the WebUI	120
In the CLI	120
Configuring Source NAT to Dynamic VLAN Address	121
In the WebUI	121
In the CLI	121
Configuring Source NAT for VLAN Interfaces	121
Example Configuration	122
In the WebUI	122
In the CLI	122
Inter-VLAN Routing	122
Using the WebUI to restrict VLAN routing	123
Using the CLI	123
Configuring Static Routes	123
In the WebUI	123
In the CLI	124
Configuring the Loopback IP Address	124
In the WebUI	124
In the CLI	124
Configuring the Controller IP Address	125
Using the CLI	125
Configuring GRE Tunnels	125
Creating a Tunnel Interface	126
In the WebUI	126
In the CLI	126
Directing Traffic into the Tunnel	126
Static Routes	126
Firewall Policy	126
In the WebUI	127
In the CLI	127
Tunnel Keepalives	127
In the WebUI	127
In the CLI	127
IPv6 Support	128
Understanding IPv6 Notation	128
Understanding IPv6 Topology	128
Enabling IPv6	129
Enabling IPv6 Support for Controller and APs	129
Configuring IPv6 Addresses	131
In the WebUI	131
To Configure Link Local Address	131
To Configure Global Unicast Address	131
To Configure Loopback Interface Address	132
In the CLI	132
Configuring IPv6 Static Neighbors	132
In the WebUI	132
In the CLI	132
Configuring IPv6 Default Gateway and Static IPv6 Routes	133
In the WebUI	133
To Configure IPv6 Default Gateway	133
To Configure Static IPv6 Routes	133
In the CLI	133
Managing Controller IP Addresses	133
In the WebUI	133
In the CLI	133
Configuring Multicast Listener Discovery (MLD)	134
In the WebUI	134
To Modify IPv6 MLD Parameters	134
In the CLI	134
Debugging an IPv6 Controller	135
In the WebUI	135
In the CLI	135
Provisioning an IPv6 AP	135
In the WebUI	135
In the CLI	135
Filtering an IPv6 Extension Header (EH)	136
Configuring a Captive Portal over IPv6	136
Working with IPv6 Router Advertisements (RAs)	136
Configuring an IPv6 RA on a VLAN	137
Using WebUI	137
Using CLI	138
Configuring Optional Parameters for RAs	138
In the WebUI	139
In the CLI	139
Viewing IPv6 RA Status	140
Understanding ArubaOS Supported Network Configuration for IPv6 Clients	140
Supported Network Configuration	140
Understanding the Network Connection Sequence for Windows IPv6 Clients	141
Understanding ArubaOS Authentication and Firewall Features that Support IPv6	141
Understanding Authentication	141
Working with Firewall Features	142
Understanding Firewall Policies	143
Creating an IPv6 Firewall Policy	145
Assigning an IPv6 Policy to a User Role	145
Understanding DHCPv6 Passthrough/Relay	146
Managing IPv6 User Addresses	146
Viewing or Deleting User Entries	146
Understanding User Roles	146
Viewing Datapath Statistics for IPv6 Sessions	146
Understanding IPv6 Exceptions and Best Practices	146
Link Aggregation Control Protocol (LACP)	148
Understanding LACP Best Practices and Exceptions	148
Configuring LACP	149
In the CLI	149
In the WebUI	150
LACP Sample Configuration	150
OSPFv2	152
Understanding OSPF Deployment Best Practices and Exceptions	152
Understanding OSPFv2 by Example using a WLAN Scenario	153
WLAN Topology	153
WLAN Routing Table	153
Understanding OSPFv2 by Example using a Branch Office Scenario	154
Branch Office Topology	154
Branch Office Routing Table	155
Configuring OSPF	155
Sample Topology and Configuration	157
Remote Branch 1	157
Remote Branch 2	158
W-3200 Central Office Controller—Active	159
W-3200 Central Office Controller—Backup	160
Tunneled Nodes	163
Understanding Tunneled Node Configuration	163
Configuring a Wired Tunneled Node Client	164
Configuring an Access Port as a Tunneled Node Port	165
Configuring a Trunk Port as a Tunneled Node Port	165
Sample Output	166
Authentication Servers	168
Understanding Authentication Server Best Practices and Exceptions	168
Understanding Servers and Server Groups	168
Configuring Servers	169
Configuring a RADIUS Server	169
Using the WebUI	170
Using the CLI	170
RADIUS Server Authentication Codes	171
RADIUS Server Fully Qualified Domain Names	171
Set a DNS Query Interval	171
Using the WebUI	171
Using the CLI	171
Configuring an RFC-3576 RADIUS Server	171
Using the WebUI	172
Using the CLI	172
Configuring an LDAP Server	172
Using the WebUI	173
Using the CLI	173
Configuring a TACACS+ Server	173
Using the WebUI	174
Using the CLI	174
Configuring a Windows Server	174
Using the WebUI	175
Using the CLI	175
Managing the Internal Database	175
Configuring the Internal Database	175
Using the WebUI	176
Using the CLI	176
Managing Internal Database Files	176
Exporting Files in the WebUI	176
Importing Files in the WebUI	177
Exporting and Importing Files in the CLI	177
Working with Internal Database Utilities	177
Deleting All Users	177
Repairing the Internal Database	177
Configuring Server Groups	177
Configuring Server Groups	178
Using the WebUI	178
Using the CLI	178
Configuring Server List Order and Fail-Through	178
Using the WebUI	179
Using the CLI	179
Configuring Dynamic Server Selection	179
Using the WebUI	180
Using the CLI	181
Configuring Match FQDN Option	181
Using the WebUI	181
Using the CLI	181
Trimming Domain Information from Requests	181
Using the WebUI	181
Using the CLI	182
Configuring Server-Derivation Rules	182
Using the WebUI	183
Using the CLI	183
Configuring a Role Derivation Rule for the Internal Database	183
Using the WebUI	183
Using the CLI	184
Assigning Server Groups	184
User Authentication	184
Management Authentication	184
Using the WebUI	184
Using the CLI	184
Accounting	185
RADIUS Accounting	185
Using the WebUI	186
Using the CLI	187
TACACS+ Accounting	187
Configuring Authentication Timers	187
Setting an Authentication Timer	188
Using the WebUI	188
Using the CLI	188
MAC-based Authentication	189
Configuring MAC-Based Authentication	189
Configuring the MAC Authentication Profile	189
Using the WebUI to configure a MAC authentication profile	190
Using the CLI to configure a MAC authentication profile	190
Configuring Clients	190
In the WebUI	190
In the CLI	191
802.1X Authentication	192
Understanding 802.1X Authentication	192
Supported EAP Types	193
Configuring Authentication with a RADIUS Server	193
Configuring Authentication Terminated on Controller	194
Configuring 802.1X Authentication	195
In the WebUI	195
In the CLI	199
Configuring and Using Certificates with AAA FastConnect	200
In the WebUI	200
In the CLI	200
Configuring User and Machine Authentication	201
Working with Role Assignment with Machine Authentication Enabled	201
Enabling 802.1x Supplicant Support on an AP	202
Prerequisites	203
Provisioning an AP as a 802.1X Supplicant	203
In the WebUI	203
In the CLI	203
Sample Configurations	204
Configuring Authentication with an 802.1X RADIUS Server	204
Configuring Roles and Policies	204
Creating the Student Role and Policy	204
In the WebUI	205
In the CLI	205
Creating the Faculty Role and Policy	206
Using the WebUI	206
In the CLI	206
Creating the Guest Role and Policy	206
In the WebUI	206
In the CLI	207
Creating Roles and Policies for Sysadmin and Computer	208
In the WebUI	208
In the CLI	208
Using the WebUI to create the computer role	208
Creating an Alias for the Internal Network Using the CLI	208
Configuring the RADIUS Authentication Server	208
In the WebUI	209
In the CLI	209
Configuring 802.1X Authentication	209
In the WebUI	209
In the CLI	210
Configuring VLANs	210
In the WebUI	210
In the CLI	211
Configuring the WLANs	211
Configuring the Guest WLAN	211
In the WebUI	211
In the CLI	212
Configuring the Non-Guest WLANs	212
In the WebUI	212
In the CLI	213
Configuring Authentication with the Controller’s Internal Database	214
Configuring the Internal Database	214
In the WebUI	214
In the CLI	214
Configuring a Server Rule Using the WebUI	214
Configuring a Server Rule Using the CLI	214
Configuring 802.1x Authentication	215
In the WebUI	215
In the CLI	215
Configuring VLANs	215
In the WebUI	216
In the CLI	216
Configuring WLANs	216
Configuring the Guest WLAN	217
In the WebUI	217
In the CLI	217
Configuring the Non-Guest WLANs	218
In the WebUI	218
In the CLI	219
Configuring Mixed Authentication Modes	219
In the CLI	219
Performing Advanced Configuration Options for 802.1X	220
Configuring Reauthentication with Unicast Key Rotation	220
In the WebUI	220
In the CLI	220
Stateful and WISPr Authentication	221
Working With Stateful Authentication	221
Working With WISPr Authentication	222
Understanding Stateful Authentication Best Practices	222
Configuring Stateful 802.1x Authentication	222
In the WebUI	223
In the CLI	223
Configuring Stateful NTLM Authentication	223
In the WebUI	223
In the CLI	224
Configuring Stateful Kerberos Authentication	224
In the WebUI	224
In the CLI	225
Configuring WISPr Authentication	225
In the WebUI	225
In the CLI	226
Certificate Revocation	228
Understanding OCSP and CRL	228
Configuring a Controller as OCSP and CRL Clients	228
Configuring an OCSP Controller as a Responder	228
Configuring the Controller as an OCSP Client	229
In the WebUI	229
In the CLI	230
Configuring the Controller as a CRL Client	230
In the WebUI	231
In the CLI	231
Configuring the Controller as an OCSP Responder	231
In the WebUI	231
In the CLI	232
Captive Portal Authentication	233
Understanding Captive Portal	233
Policy Enforcement Firewall Next Generation (PEFNG) License	234
Controller Server Certificate	234
Configuring Captive Portal in the Base Operating System	234
In the WebUI	235
In the CLI	236
Using Captive Portal with a PEFNG License	237
Configuring Captive Portal in the WebUI	238
Configuring Captive Portal in the CLI	239
Sample Authentication with Captive Portal	239
Creating a Guest User Role	239
Creating an Auth-guest User Role	240
Configuring Policies and Roles in the WebUI	240
Creating a Time Range	240
Creating Aliases	241
Creating an Auth-Guest-Access Policy	241
Creating an Block-Internal-Access Policy	242
Creating a Drop-and-Log Policy	243
Creating a Guest Role	243
Creating an Auth-Guest Role	244
Configuring Policies and Roles in the CLI	244
Defining a Time Range	244
Creating Aliases	244
Creating a Guest-Logon-Access Policy	245
Creating an Auth-Guest-Access Policy	245
Creating a Block-Internal-Access Policy	245
Creating a Drop-and-Log Policy	245
Creating a Guest-Logon Role	245
Creating an Auth-Guest Role	245
Configuring Guest VLANs	245
In the WebUI	246
In the CLI	246
Configuring Captive Portal Authentication Profiles	246
Modifying the Initial User Role	247
Configuring the AAA Profile	247
Configuring the WLAN	248
Managing User Accounts	248
Configuring Captive Portal Configuration Parameters	249
Enabling Optional Captive Portal Configurations	250
Uploading Captive Portal Pages by SSID Association	251
Changing the Protocol to HTTP	251
Configuring Redirection to a Proxy Server	252
Redirecting Clients on Different VLANs	253
Web Client Configuration with Proxy Script	254
Personalizing the Captive Portal Page	254
Creating and Installing an Internal Captive Portal	256

Match case Limit results 1 per page

201 | 802.1X Authentication

DellPowerConnect W-Series ArubaOS 6.2 | User Guide

server-cert <certificate>

ca-cert <certificate>

Configuring User and Machine Authentication

When a Windows device boots, it logs onto the network domain using a machine account. Within the domain, the

device is authenticated before computer group policies and software settings can be executed; this process is known

machine authentication

. Machine authentication ensures that only authorized devices are allowed on the network.

You can configure 802.1x for both user and machine authentication (select the

Enforce Machine Authentication

option described in

Table 61

). This tightens the authentication process further since both the device and user need

to be authenticated.

Working with Role Assignment with Machine Authentication Enabled

When you enable machine authentication, there are two additional roles you can define in the 802.1x authentication

profile:

Machine authentication default machine role

Machine authentication default user role

While you can select the same role for both options, you should define the roles as per the polices that need to be

enforced. Also, these roles can be different from the 802.1x authentication default role configured in the AAA profile.

With machine authentication enabled, the assigned role depends upon the success or failure of the machine and user

authentications. In certain cases, the role that is ultimately assigned to a client can also depend upon attributes

returned by the authentication server or server derivation rules configured on the controller.

Table 62

describes role assignment based on the results of the machine and user authentications.

Machine

Auth

Status

User

Auth

Status

Description

Role Assigned

Failed

Both machine authentication and user

authentication failed. L2 authentication

failed.

No role assigned. No access to the network

allowed.

Failed

Passed

Machine authentication fails (for example,

the machine information is not present on

the server) and user authentication

succeeds. Server-derived roles do not apply.

Machine authentication default user role

configured in the 802.1x authentication

profile.

Passed

Failed

Machine authentication succeeds and user

authentication has not been initiated. Server-

derived roles do not apply.

Machine authentication default machine

role configured in the 802.1x authentication

profile.

Passed

Both machine and user are successfully

authenticated. If there are server-derived

roles, the role assigned via the derivation

take precedence. This is the

only

case

where server-derived roles are applied.

A role derived from the authentication

server takes precedence. Otherwise, the

802.1x authentication default role configured

in the AAA profile is assigned.

Table 62:

Role Assignment for User and Machine Authentication

For example, if the following roles are configured:

802.1x authentication default role (in AAA profile): dot1x_user

Machine authentication default machine role (in 802.1x authentication profile): dot1x_mc