Cisco Cisco Access Registrar 4.2 Dokumentacja Pobierz pdf (Strona 244)

5-60

Cisco Wireless LAN Controller Configuration Guide

OL-13826-01

Chapter 5 Configuring Security Solutions

Configuring Identity Networking

• Vendor type – 5

• Vendor length – >0

• Value – A string that includes the name of the interface the client is to be assigned to.

Note This Attribute only works when MAC filtering is enabled or if 802.1X or WPA is used as the

security policy.

VLAN-Tag

This attribute indicates the group ID for a particular tunneled session, and is also known as the

Tunnel-Private-Group-ID attribute.

This attribute might be included in the Access-Request packet if the tunnel initiator can predetermine

the group resulting from a particular connection and should be included in the Access-Accept packet if

this tunnel session is to be treated as belonging to a particular private group. Private groups may be used

to associate a tunneled session with a particular group of users. For example, it may be used to facilitate

routing of unregistered IP addresses through a particular interface. It should be included in

Accounting-Request packets which contain Acct-Status-Type attributes with values of either Start or

Stop and which pertain to a tunneled session.

A summary of the Tunnel-Private-Group-ID Attribute format is shown below. The fields are transmitted

from left to right.

0123

01234567890123456789012345678901

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

| Type | Length | Tag | String...

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

• Type – 81 for Tunnel-Private-Group-ID.

• Length – >= 3

• Tag – The Tag field is one octet in length and is intended to provide a means of grouping attributes

in the same packet which refer to the same tunnel. If the value of the Tag field is greater than 0x00

and less than or equal to 0x1F, it should be interpreted as indicating which tunnel (of several

alternatives) this attribute pertains. If the Tag field is greater than 0x1F, it should be interpreted as

the first byte of the following String field.

• String – This field must be present. The group is represented by the String field. There is no

restriction on the format of group IDs.

Tunnel Attributes

Note When any of the other RADIUS attributes (QoS-Level, ACL-Name, Interface-Name, or VLAN-Tag) are

returned, the Tunnel Attributes must also be returned.

Reference RFC2868 defines RADIUS tunnel attributes used for authentication and authorization, and

RFC2867 defines tunnel attributes used for accounting. Where the IEEE 802.1X Authenticator supports

tunneling, a compulsory tunnel may be set up for the Supplicant as a result of the authentication.

In particular, it may be desirable to allow a port to be placed into a particular Virtual LAN (VLAN),

defined in IEEE8021Q, based on the result of the authentication. This can be used, for example, to allow

a wireless host to remain on the same VLAN as it moves within a campus network.

1 2 ... 239 240 241 242 243 244 245 246 247 248 249 ... 635 636

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco Cisco Access Registrar 4.2 Dokumentacja Strona 244

Komentarze do niniejszej Instrukcji