SGS-6341-Series User Manual

 There are three access control methods (the methods to authenticate users): port-
based,
MAC-based and user-based (IP address+ MAC address+ port).
 When the port-based method is used, as long as the first user of this port passes the
authentication, all the other users can access the network resources without being
authenticated. However, once the first user is offline, the network won’t be available
to all the other users.
 When the MAC-based method is used, all the users accessing a port should be
authenticated separately, only those pass the authentication can access the network,
while the others can not. When one user becomes offline, the other users will not be
affected.
 When the user-based (IP address+ MAC address+ port) method is used, all users
can access limited resources before being authenticated. There are two kinds of
control in this method: standard control and advanced control. The user-based
standard control will not restrict the access to limited resources, which means all
users of this port can access limited resources before being authenticated. The
user-based advanced control will restrict the access to limited resources, only some
particular users of the port can access limited resources before being authenticated.
Once those users pass the authentication, they can access all resources.
Attention: When using private supplicant systems, user-based advanced control is
recommended to effectively prevent ARP cheat. The maximum number of the authenticated
users can be 4000, but less than 2000 will be preferred.
42.1.7 The Features of VLAN Allocation
1. Auto VLAN
Auto VLAN feature enables RADIUS server to change the VLAN to which the access port
belongs, based on the user information and the user access device information. When an
802.1x user passes authentication on the server, the RADIUS server will send the
authorization information to the device, if the RADIUS server has enabled the VLAN-assigning
function, then the following attributes should be included in the Access-Accept messages:
 Tunnel-Type = VLAN (13)
 Tunnel-Medium-Type = 802 (6)
 Tunnel-Private-Group-ID = VLANID
The VLANID here means the VID of VLAN, ranging from 1 to 4094. For example,
Tunnel-Private-Group-ID = 30 means VLAN 30.
When the switch receives the assigned Auto VLAN information, the current Access port will
leave the VLAN set by the user and join Auto VLAN. Auto VLAN won’t change or affect the
42-82
User’s Manual of SGS-6341 series