Enterasys Networks 9034313-07 manual Configuring Policy Maptable Response

Configuring Policy Maptable Response

Parameters

port‐string	(Optional) Displays VLAN authentication status for the specified ports. If
	no port string is entered, then the global status of the setting is displayed.
	For a detailed description of possible port‐string values, refer to “Port
	String Syntax Used in the CLI” on page 7‐1.

Defaults

If no port string is entered, the status for all ports will be displayed.

Mode

Switch command, read‐only.

Example

This command shows how to display VLAN authorization status for ge.1.1:

C3(su)->show vlanauthorization ge.1.1
Vlan Authorization: - enabled			operational	authenticated	vlan id
port	status	administrative
-------	--------	egress	egress	mac address	-------
		--------------	-----------	-----------------
ge.1.1	enabled	untagged

Table 26‐5 provides an explanation of command output. For details on enabling and assigning protocol and egress attributes, refer to “set vlanauthorization” on page 26‐50 and “set vlanauthorization egress” on page 26‐50.

Table 26-5 show vlanauthorization Output Details

Output Field	What It Displays...
port	Port identification
status	Port status as assigned by set vlanauthorization command
administrative	Port status as assigned by the set vlanauthorization egress command
egress
operational egress	Port operational status of vlanauthorization egress.
authenticated mac	If authentication has succeeded, displays the MAC address assigned for egress.
address
vlan id	If authentication has succeeded, displays the assigned VLAN id for ingress.

Configuring Policy Maptable Response

The policy maptable response feature allows you to define how the system should handle allowing an authenticated user onto a port based on the contents of the RADIUS server Access‐ Accept reply. There are three possible response settings: tunnel mode, policy mode, or both tunnel and policy, also known as hybrid authentication mode.

When the maptable response is set to tunnel mode, the system will use the tunnel attributes in the RADIUS reply to apply a VLAN to the authenticating user and will ignore any Filter‐ID attributes in the RADIUS reply. On this platform, when tunnel mode is configured, no VLAN‐to‐policy mapping will occur. When using VLAN authorization, the policy maptable response should be set to tunnel (see “Configuring VLAN Authorization (RFC 3580)” on page 26‐49).

26-52 Authentication and Authorization Configuration