Brocade Communications Systems 6650 Using MAC-based VLANs and 802.1X security on the same port

MAC-based VLAN configuration

Using MAC-based VLANs and 802.1X security on the same port

On Brocade devices, MAC-based VLANs and 802.1X security can be configured on the same port. When both of these features are enabled on the same port, MAC-based VLAN is performed prior to 802.1X authentication. If MAC-based VLAN is successful, 802.1X authentication may be performed, based on the configuration of a vendor-specific attribute (VSA) in the profile for the MAC address on the RADIUS server.

When both features are configured on a port, a device connected to the port is authenticated as follows.

1.MAC-based VLAN is performed on the device to authenticate the device MAC address.

2.If MAC-based VLAN is successful, the device then checks to see if the RADIUS server included the Foundry-802_1x-enable VSA (described in Table 47) in the Access-Accept message that authenticated the device.

3.If the Foundry-802_1x-enable VSA is not present in the Access-Accept message, or is present and set to 1, then 802.1X authentication is performed for the device.

4.If the Foundry-802_1x-enable VSA is present in the Access-Accept message, and is set to 0, then 802.1X authentication is skipped.

Configuring generic and Brocade vendor-specific attributes on the RADIUS server

If the RADIUS authentication process is successful, the RADIUS server sends an Access-Accept message to the Brocade device, authenticating the device. The Access-Accept message includes Vendor-Specific Attributes (VSAs) that specify additional information about the device.

Add Brocade vendor-specific attributes to your RADIUS server configuration, and configure the attributes in the individual or group profiles of the devices that will be authenticated. Brocade. vendor-ID is 1991, vendor-type 1. Table 46 lists generic RADIUS attributes. Table 47 lists Brocade Vendor-Specific Attributes.

TABLE 46	Generic RADIUS attributes
Attribute name		Attribute ID	Data type	Optional or	Description
				mandatory
Tunnel-Type		64	13	Mandatory	RFC 2868.
			decimal
			VLAN
Tunnel-Medium-Type		65	6	Mandatory	RFC 2868.
			decimal
			802
Tunnel-Private-Group-ID		81	decimal	Mandatory	RFC 2868. vlan-idor U:vlan -id– a
					MAC-based VLAN ID configured on the
					Brocade device.

216	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01