Netgear XCM8806 - 8800 SERIES 6-SLOT CHASSIS SWITCH ユーザーズマニュアル
418
|
Chapter 16. Network Login
NETGEAR 8800 User Manual
Web-Based Network Login Configuration Example
The following configuration example shows both the NETGEAR switch configuration and the
RADIUS server entries needed to support the example. VLAN corp is assumed to be a
corporate subnet which has connections to DNS, WINS servers, network routers, and so on.
VLAN temp is a temporary VLAN and is created to provide connections to unauthenticated
network login clients. Unauthenticated ports belong to the VLAN temp. This kind of
configuration provides better security as unauthenticated clients do not connect to the
corporate subnet and will not be able to send or receive any data. They have to get
authenticated in order to have access to the network.
RADIUS server entries needed to support the example. VLAN corp is assumed to be a
corporate subnet which has connections to DNS, WINS servers, network routers, and so on.
VLAN temp is a temporary VLAN and is created to provide connections to unauthenticated
network login clients. Unauthenticated ports belong to the VLAN temp. This kind of
configuration provides better security as unauthenticated clients do not connect to the
corporate subnet and will not be able to send or receive any data. They have to get
authenticated in order to have access to the network.
•
ISP Mode—Network login clients connected to ports 1:10 - 1:14, VLAN corp, will be
logged into the network in ISP mode. This is controlled by the fact that the VLAN in which
they reside in unauthenticated mode and the RADIUS server Vendor Specific Attributes
(VSA),
they reside in unauthenticated mode and the RADIUS server Vendor Specific Attributes
(VSA),
Netgear-Netlogin-Vlan
, are the same, corp. So there will be no port movement.
Also if this VSA is missing from RADIUS server, it is assumed to be ISP Mode.
•
Campus Mode—On the other hand, clients connected to ports 4:1 - 4:4, VLAN temp, will
be logged into the network in Campus mode since the port will move to the VLAN corp
after getting authenticated. A port moves back and forth from one VLAN to the other as its
authentication state changes.
after getting authenticated. A port moves back and forth from one VLAN to the other as its
authentication state changes.
Both ISP and Campus mode are not tied to ports but to a user profile. In other words, if the
VSA
VSA
Netgear:Netgear-Netlogin-Vlan
represents a VLAN different from the one in which the
user currently resides, then VLAN movement will occur after login and after logout. In
following example, it is assumed that campus users are connected to ports 4:1-4:4, while ISP
users are logged in through ports 1:10-1:14.
following example, it is assumed that campus users are connected to ports 4:1-4:4, while ISP
users are logged in through ports 1:10-1:14.
Note:
In the following sample configuration, any lines marked (
Default
)
represent default settings and do not need to be explicitly
configured.
configured.
create vlan “temp”
create vlan “corp”
configure vlan “default” delete ports 4:1-4:4
enable ipforwarding
# Configuration Information for VLAN temp
# No VLAN-ID is associated with VLAN temp.
configure vlan “temp” ipaddress 198.162.32.10 255.255.255.0
# Configuration Information for VLAN corp
# No VLAN-ID is associated with VLAN corp.
configure vlan “corp” ipaddress 10.203.0.224 255.255.255.0
configure vlan “corp” add port 1:10 untagged