How to restrict authentication attempts from restrict VLAN

Created: Apr 24, 2017 08:47:55Latest reply: Apr 24, 2017 09:18:52 792 1 0 0

Let's consider this scenario:

S2750 with V200R006 or later software release configured with 802.1x authentication on access ports. We have 3 VLANs,

VLAN A it's use for RADIUS LDAP communication.

VLAN B it's the network VLAN on which user gets after it pass dot1x authentication successfully.

VLAN C it's the restrict VLAN on which user gets after dot1x authentication fails.


The requirement:

After user fails authentication and gets into restrict VLAN, switch should not allow the user to try authentication again even if it will use the correct credentials to perform authentication.

Configuration example:

>> interface Ethernet0/0/10
>>     port link-type hybrid
>>     port hybrid pvid vlan A
>>     port hybrid untagged vlan A B C
>>     dot1x enable
>>     dot1x max-user 2
>>     authentication restrict-vlan C
>>     dot1x reauthenticate
>>     dot1x authentication-method eap

  • x
  • convention:

ms.america     Created Apr 24, 2017 09:18:52 Helpful(0) Helpful(0)

With other words, the requirement is to filter the EAP requests coming from restrict VLAN.

The easiest way to achieve this is to configure a classifier that match the EAP request parameters for vlan 400 and blacklist the packets that match the ACL rule. Check below:

> acl number 4000
> rule 5 permit l2-protocol 0x888e vlan-id 400
>   
> cpu-defend policy YYYY
> blacklist 1 acl 4000
>   
> cpu-defend-policy YYYY global

this configure with forbid switch to process any EAP requests coming from restrict VLAN.

  • x
  • convention:

Reply

Reply
You need to log in to reply to the post Login | Register

Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " Privacy."
If the attachment button is not available, update the Adobe Flash Player to the latest version!
Fast reply Scroll to top