Configuring the RADIUS Server to Support Dynamic VLAN Assignment for Authentication

Dynamic VLAN assignments from the RADIUS server can be enabled in multiple formats. VLAN assignments can be tagged, untagged, single, multiple, or a combination of tagged and untagged VLANs for different use cases, for example, with client devices such as computers, IP phones, wireless access points, or servers running hypervisors that have multiple Virtual Machines (VMs).

To specify VLAN identifiers on the RADIUS server, add the attributes in the following table to the device (client) profile for MAC authentication. For 802.1X authentication, add these attributes to the user (client) profile.

Attributes for Dynamic VLAN Assignment

Attribute Name

Type

Value

Tunnel-Type

064

13 (decimal) - VLAN

Tunnel-Medium-Type

065

6 (decimal) - IEEE-802

Tunnel-Private-Group-ID

081

vlan-id or vlan-name (untagged)

U:vlan-id of U:vlan-name (untagged)

T:vlan-id or T:vlan-name (tagged)

Note: A maximum of 32 dynamic VLANs can be sent from RADIUS with a Tunnel-Private-Group-ID in the format U: multiple T: where U and T both represent either a VLAN-name or a VLAN-ID.
Note: Different formats are supported for Tunnel-Private-Group-ID in different FastIron releases. FastIron 08.0.30b and later releases support the following formats:
  • vlan-id or vlan-name
  • U:vlan-id or U:vlan-name
  • T:vlan-id or T:vlan-name
  • U:vlan-id T:vlan-name
  • multiple T:<>
  • U: multiple T:<>

The ICX device interprets the attributes as follows:

  • If the Tunnel-Type or the Tunnel-Medium-Type attributes in the Access-Accept message do not have the specified values, the ICX device ignores these Attribute-Value pairs. If the Tunnel-Private-Group-ID is valid, the client is authorized in this VLAN; otherwise, it is authorized in the auth-default VLAN.
  • When the ICX device receives and parses the Tunnel-Private-Group-ID attribute, it checks whether the vlan-name string matches the name of a configured VLAN or the vlan-id on the ICX device. If there is a VLAN match, the client port is placed in the VLAN.
  • If the vlan-name string does not match either the name or the ID of a VLAN configured on the ICX device, the VLAN name or ID is created and then used.
Parent topic: Dynamic VLAN Assignment