White Papers

VTY MAC-SA Filter Support
supports MAC access lists which permit or deny users based on their source MAC address.
With this approach, you can implement a security policy based on the source MAC address.
To apply a MAC ACL on a VTY line, use the same access-class command as IP ACLs.
The following example shows how to deny incoming connections from subnet 10.0.0.0 without displaying a login prompt.
Example of Configuring VTY Authorization Based on MAC ACL for the Line (Per MAC Address)
DellEMC(conf)#mac access-list standard sourcemac
DellEMC(config-std-mac)#permit 00:00:5e:00:01:01
DellEMC(config-std-mac)#deny any
DellEMC(conf)#
DellEMC(conf)#line vty 0 9
DellEMC(config-line-vty)#access-class sourcemac
DellEMC(config-line-vty)#end
Support for Change of Authorization and Disconnect
Messages packets
The Network Access Server (NAS) uses RADIUS to authenticate AAA or dot1x user-access to the switch. The RADIUS service
does not support unsolicited messages sent from the RADIUS server to the NAS.
However, there are many instances in which it is desirable for changes to be made to session characteristics, without requiring
the NAS to initiate the exchange. For example, it may be desirable for administrators to be able to terminate user sessions in
progress.
Alternatively, if the user changes authorization level, this change may require that authorization attributes be added or deleted
from the user sessions.
To overcome these limitations, Dell EMC Networking OS provides RADIUS extension commands in order to enable unsolicited
messages to be sent to the NAS. These extension commands provide support for Disconnect Messages (DMs) and Change-of-
Authorization (CoA) packets. DMs cause user sessions to be terminated immediately; whereas, CoA packets modify session
authorization attributes such as VLAN IDs, user privileges, and so on.
Change of Authorization (CoA) packets
Using the CoA packets, the NAS can handle authorization of dot1x sessions by processing the following requests from the
Dynamic Authorization Client (DAC): Re-authentication of the supplicant, Port disable, and Port bounce.
The CoA packets constitute one message request (CoA request) and one of the following two possible responses:
● Change of Authorization Acknowledgement (CoA-Ack) - If the authorization state change is successful, then NAS sends a
CoA-Ack.
● Change of Authorization non-Acknowledgement (CoA-Nak) - If the authorization state change is not successful, then the
NAS sends a CoA-Nak, which is a negative acknowledgement.
Disconnect Messages
Using the Disconnect Messages, the NAS can disconnect AAA and dot1x sessions. NAS can disconnect AAA sessions using
either username or a combination of the username and session id. NAS can disconnect dot1x sessions using NAS-port, or
calling-station ID, or both.
The disconnect messages constitue one message request (DM request) and one of the following two possible responses:
● Disconnect Acknowledgement (DM-Ack) - If the session is disconnected successfully, then NAS sends a DM-Ack.
● Disconnect non-Acknowledgement (DM-Nak) - If the session is not disconnected successfully, then NAS sends a DM-Nak.
770
Security