Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring 802.1X Authentication Options When the RADIUS Server is Unavailable to an EX Series Switch

Requirements

• Junos OS Release 9.3 or later for EX Series switches
• One EX Series switch acting as an authenticator port access entity (PAE). The ports on the authenticator PAE form a control gate that blocks all traffic to and from supplicants until they are authenticated.
• One RADIUS authentication server that supports 802.1X. The authentication server acts as the backend database and contains credential information for hosts (supplicants) that have permission to connect to the network.

Before you connect the server to the switch, be sure you have:

• Performed basic bridging and VLAN configuration on the switch. See the documentation that describes setting up basic bridging and a VLAN for your switch. If you are using a switch that supports the Enhanced Layer 2 Software (ELS) configuration style, see Example: Setting Up Basic Bridging and a VLAN for an EX Series Switch. For all other switches, see Example: Setting Up Basic Bridging and a VLAN for an EX Series Switch.

  Note: For more about ELS, see: Getting Started with Enhanced Layer 2 Software

• Set up a connection between the switch and the RADIUS server. See Example: Connecting a RADIUS Server for 802.1X to an EX Series Switch.
• Disable firewall filters on the interface. Firewall filters interfere with server fail fallback operation.
• Configured users on the authentication server.

Overview and Topology

A RADIUS server timeout occurs if no authentication RADIUS servers are reachable when a supplicant logs in and attempts to access the LAN. Using server fail fallback, configure alternative options for supplicants attempting LAN access. You can configure the switch to accept or deny access to supplicants or to maintain the access already granted towards supplicants before the RADIUS server timeout. Additionally, you can configure the switch to move supplicants to a specific VLAN if a RADIUS timeout occurs or if the RADIUS server sends an EAP Access-Reject message. Figure 1 shows the topology used for this example. The RADIUS server is connected to the EX4200 switch on access port ge-0/0/10. The switch acts as the authenticator Port Access Entity (PAE) and forwards credentials from the supplicant to the user database on the RADIUS server. The switch blocks all traffic and acts as a control gate until the supplicant is authenticated by the authentication server. A supplicant is connected to the switch through interface ge-0/0/1.

Figure 1: Topology for Configuration

Table 1 describes the components in this topology.

In this example, configure interface ge-0/0/1 to move a supplicant attempting access to the LAN during a RADIUS timeout to another VLAN. A RADIUS timeout prevents the normal exchange of EAP messages that carry information from the RADIUS server to the switch and permit the authentication of a supplicant. The default VLAN is configured on interface ge-0/0/1. When a RADIUS timeout occurs, supplicants on the interface will be moved from the default VLAN to the VLAN named vlan-sf.

Note: For more information about authentication, authorization, and accounting (AAA) services, see Junos OS System Basics Configuration Guide.

Configuration

CLI Quick Configuration

To quickly configure server fail fallback on the switch, copy the following commands and paste them into the switch terminal window:

Step-by-Step Procedure

1. Define the VLAN to which supplicants are diverted:
   [edit protocols dot1x authenticator]
user@switch# set interface ge-0/0/1 server-fail vlan-name vlan-sf

Results

Display the results of the configuration:

Verification

To confirm that the configuration is working properly, perform these tasks:

• Verifying That the Supplicants Are Moved to an Alternative VLAN During a RADIUS Timeout

Verifying That the Supplicants Are Moved to an Alternative VLAN During a RADIUS Timeout

Purpose

Verify that the interface moves supplicants to an alternative VLAN during a RADIUS timeout.

Note: On switches running Junos OS for EX Series with support for the Enhanced Layer 2 Software (ELS), the output for the show vlans command will contain additional information. If your switch runs software that supports ELS, see show vlans. For ELS details, see Getting Started with Enhanced Layer 2 Software

Action

Name           Tag     Interfaces
default       
                       ge-0/0/0.0, ge-0/0/1.0*, ge-0/0/5.0*, ge-0/0/10.0,
                       ge-0/0/12.0*, ge-0/0/14.0*, ge-0/0/15.0, ge-0/0/20.0
v2             77     
                       None
vlan—sf        50     
                       None
mgmt          
                       me0.0*
  

802.1X Information:
Interface     Role           State           MAC address          User
ge-0/0/1.0    Authenticator  Authenticated   00:00:00:00:00:01    abc     
ge-0/0/10.0   Authenticator  Initialize     
ge-0/0/14.0   Authenticator  Connecting     
ge-0/0/15.0   Authenticator  Initialize     
ge-0/0/20.0   Authenticator  Initialize     

Ethernet-switching table: 3 entries, 1 learned
  VLAN              MAC address       Type         Age Interfaces
  v1                *                 Flood          - All-members
  vlan—sf           00:00:00:00:00:01 Learn       1:07 ge-0/0/1.0
  default           *                 Flood          - All-members

     
802.1X Information:
Interface     Role           State           MAC address          User
ge-0/0/1.0    Authenticator  Connecting     
ge-0/0/10.0   Authenticator  Initialize     
ge-0/0/14.0   Authenticator  Connecting     
ge-0/0/15.0   Authenticator  Initialize     
ge-0/0/20.0   Authenticator  Initialize     

Meaning

The command show vlans displays interface ge-0/0/1.0 as a member of the default VLAN. The command show dot1x interface brief shows that a supplicant (abc) is authenticated on interface ge-0/0/1.0 and has the MAC address 00:00:00:00:00:01. A RADIUS server timeout occurs, and the authentication server cannot be reached by the switch. The command show-ethernet-switching table shows that MAC address 00:00:00:00:00:01 is learned on VLAN vlan-sf. The supplicant has been moved from the default VLAN to the vlan-sf VLAN. The supplicant is then connected to the LAN through the VLAN named vlan-sf.