TechLibrary

Access Control Overview
802.1X for EX Series Switches Overview Understanding Authentication on EX Series Switches Understanding Guest VLANs for 802.1X on EX Series Switches Understanding 802.1X and RADIUS Accounting on EX Series Switches Understanding 802.1X and LLDP and LLDP-MED on EX Series Switches Understanding 802.1X and VoIP on EX Series Switches Understanding 802.1X and VSAs on EX Series Switches Understanding Dynamic VLANs for 802.1X on EX Series Switches Understanding Server Fail Fallback and Authentication on EX Series Switches Authentication Process Flow for EX Series Switches Understanding Authentication Session Timeout Understanding NetBIOS Snooping Understanding Centralized Network Access Control and EX Series Switches

Access Control Overview

802.1X for EX Series Switches Overview

Understanding Authentication on EX Series Switches

Understanding Guest VLANs for 802.1X on EX Series Switches

Understanding 802.1X and RADIUS Accounting on EX Series Switches

Understanding 802.1X and LLDP and LLDP-MED on EX Series Switches

Understanding 802.1X and VoIP on EX Series Switches

Understanding 802.1X and VSAs on EX Series Switches

Understanding Dynamic VLANs for 802.1X on EX Series Switches

Understanding Server Fail Fallback and Authentication on EX Series Switches

Authentication Process Flow for EX Series Switches

Understanding Authentication Session Timeout

Understanding NetBIOS Snooping

Understanding Centralized Network Access Control and EX Series Switches

Configuration Examples
Example: Connecting a RADIUS Server for 802.1X to an EX Series Switch Example: Setting Up 802.1X in Conference Rooms to Provide Internet Access to Corporate Visitors on an EX Series Switch Example: Setting Up 802.1X for Single Supplicant or Multiple Supplicant Configurations on an EX Series Switch Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch Example: Configuring VoIP on an EX Series Switch Without Including LLDP-MED Support Example: Configuring VoIP on an EX Series Switch Without Including 802.1X Authentication Example: Configuring Static MAC Bypass of Authentication on an EX Series Switch Example: Configuring 802.1X Authentication Options When the RADIUS Server is Unavailable to an EX Series Switch Example: Configuring MAC RADIUS Authentication on an EX Series Switch Example: Applying a Firewall Filter to 802.1X-Authenticated Supplicants Using RADIUS Server Attributes on an EX Series Switch Example: Applying Firewall Filters to Multiple Supplicants on Interfaces Enabled for 802.1X or MAC RADIUS Authentication Example: Setting Up Captive Portal Authentication on an EX Series Switch Example: Configuring Fallback Options on EX Series Switches for EAP-TTLS Authentication and Odyssey Access Clients Example: Configuring Centralized Access Control to Network Resources, with an EX Series Switch Connected to Junos Pulse Access Control Service

Configuration Examples

Example: Connecting a RADIUS Server for 802.1X to an EX Series Switch

Example: Setting Up 802.1X in Conference Rooms to Provide Internet Access to Corporate Visitors on an EX Series Switch

Example: Setting Up 802.1X for Single Supplicant or Multiple Supplicant Configurations on an EX Series Switch

Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch

Example: Configuring VoIP on an EX Series Switch Without Including LLDP-MED Support

Example: Configuring VoIP on an EX Series Switch Without Including 802.1X Authentication

Example: Configuring Static MAC Bypass of Authentication on an EX Series Switch

Example: Configuring 802.1X Authentication Options When the RADIUS Server is Unavailable to an EX Series Switch

Example: Configuring MAC RADIUS Authentication on an EX Series Switch

Example: Applying a Firewall Filter to 802.1X-Authenticated Supplicants Using RADIUS Server Attributes on an EX Series Switch

Example: Applying Firewall Filters to Multiple Supplicants on Interfaces Enabled for 802.1X or MAC RADIUS Authentication

Example: Setting Up Captive Portal Authentication on an EX Series Switch

Example: Configuring Fallback Options on EX Series Switches for EAP-TTLS Authentication and Odyssey Access Clients

Example: Configuring Centralized Access Control to Network Resources, with an EX Series Switch Connected to Junos Pulse Access Control Service

Configuration Tasks
Configuring 802.1X Interface Settings (CLI Procedure) Configuring 802.1X Authentication (J-Web Procedure) Configuring 802.1X RADIUS Accounting (CLI Procedure) Filtering 802.1X Supplicants Using RADIUS Server Attributes Configuring LLDP (CLI Procedure) Configuring LLDP (J-Web Procedure) Configuring LLDP-MED (CLI Procedure) VSA Match Conditions and Actions Configuring Server Fail Fallback (CLI Procedure) Configuring MAC RADIUS Authentication (CLI Procedure) Configuring Static MAC Bypass of Authentication (CLI Procedure) Specifying RADIUS Server Connections on an EX Series Switch (CLI Procedure) Configuring Captive Portal Authentication (CLI Procedure) Designing a Captive Portal Authentication Login Page on an EX Series Switch Controlling Authentication Session Timeouts (CLI Procedure) Configuring NetBIOS Snooping (CLI Procedure) Configuring an EX Series Switch to Use Junos Pulse Access Control Service for Network Access Control (CLI Procedure) Configuring the EX Series Switch for Captive Portal Authentication with Junos Pulse Access Control Service (CLI Procedure)

Configuration Tasks

Configuring 802.1X Interface Settings (CLI Procedure)

Configuring 802.1X Authentication (J-Web Procedure)

Configuring 802.1X RADIUS Accounting (CLI Procedure)

Filtering 802.1X Supplicants Using RADIUS Server Attributes

Configuring LLDP (CLI Procedure)

Configuring LLDP (J-Web Procedure)

Configuring LLDP-MED (CLI Procedure)

VSA Match Conditions and Actions

Configuring Server Fail Fallback (CLI Procedure)

Configuring MAC RADIUS Authentication (CLI Procedure)

Configuring Static MAC Bypass of Authentication (CLI Procedure)

Specifying RADIUS Server Connections on an EX Series Switch (CLI Procedure)

Configuring Captive Portal Authentication (CLI Procedure)

Designing a Captive Portal Authentication Login Page on an EX Series Switch

Controlling Authentication Session Timeouts (CLI Procedure)

Configuring NetBIOS Snooping (CLI Procedure)

Configuring an EX Series Switch to Use Junos Pulse Access Control Service for Network Access Control (CLI Procedure)

Configuring the EX Series Switch for Captive Portal Authentication with Junos Pulse Access Control Service (CLI Procedure)

Configuration Statements
[edit access] Configuration Statement Hierarchy on EX Series Switches [edit ethernet-switching-options] Configuration Statement Hierarchy on EX Series Switches [edit protocols] Configuration Statement Hierarchy on EX Series Switches [edit protocols dot1x] Configuration Statement Hierarchy on EX Series Switches [edit protocols lldp] Configuration Statement Hierarchy on EX Series Switches [edit protocols lldp-med] Configuration Statement Hierarchy on EX Series Switches access accounting (Access Profile) accounting accounting-port (RADIUS Server) accounting-port accounting-server accounting-session-id-format accounting-stop-on-access-deny accounting-stop-on-failure address address (Access Control Service) address-pool address-range advertisement-interval attributes authentication-order authentication-profile-name authentication-server authentication-whitelist authenticator block-interval ca-type ca-value captive-portal certificate-verification civic-based country-code custom-options destination disable (802.1X) disable (LLDP) disable (LLDP-MED) disable (LLDP Power Negotiation) dot1x elin eapol-block ethernet-port-type-virtual ethernet-switching-options events exclude fast-start (LLDP-MED) forwarding-class (VoIP) guest-vlan hold-multiplier ignore immediate-update infranet-controller interface (802.1X) interface (Access Control Service) interface (Captive Portal) interface (LLDP) interface (LLDP-MED) interface (Static MAC Bypass) interface (VoIP) interface-description-format interval (Access Control Service) lldp lldp-configuration-notification-interval lldp-med (Ethernet Switching) lldp-med-bypass lldp-priority location (LLDP-MED) mac-radius management-address maximum-requests nas-identifier nas-port-extended-format netbios-snooping no-mac-table-binding no-reauthentication no-tagging options order password (Access Control Service) port port (Access Control Service) port (RADIUS Server) port (TACACS+ Server) power-negotiation profile ptopo-configuration-maximum-hold-time ptopo-configuration-trap-interval quiet-period quiet-period (Captive Portal) radius (Access Profile) radius (System) radius radius-server reauthentication retries retries (Captive Portal) retry retry (RADIUS) revert-interval routing-instance secret secret secure-authentication server (RADIUS Accounting) server (TACACS+ Accounting) server-fail server-reject-vlan server-timeout server-timeout (Captive Portal) session-expiry single-connection source-address source-address (NTP, RADIUS, System Logging, or TACACS+) static (Protocols 802.1X) statistics supplicant supplicant-timeout tacplus timeout (System) timeout (Access Control Service) timeout (RADIUS) timeout-action (Access Control Service) traceoptions (802.1X) traceoptions (LLDP) transmit-delay transmit-period uac-policy uac-service unified-access-control update-interval vlan-assignment vlan-nas-port-stacked-format voip what

Configuration Statements

[edit access] Configuration Statement Hierarchy on EX Series Switches

[edit ethernet-switching-options] Configuration Statement Hierarchy on EX Series Switches

[edit protocols] Configuration Statement Hierarchy on EX Series Switches

[edit protocols dot1x] Configuration Statement Hierarchy on EX Series Switches

[edit protocols lldp] Configuration Statement Hierarchy on EX Series Switches

[edit protocols lldp-med] Configuration Statement Hierarchy on EX Series Switches

access

accounting (Access Profile)

accounting

accounting-port (RADIUS Server)

accounting-port

accounting-server

accounting-session-id-format

accounting-stop-on-access-deny

accounting-stop-on-failure

address

address (Access Control Service)

address-pool

address-range

advertisement-interval

attributes

authentication-order

authentication-profile-name

authentication-server

authentication-whitelist

certificate-verification

disable (LLDP Power Negotiation)

dot1x

elin

eapol-block

ethernet-port-type-virtual

ethernet-switching-options

events

exclude

fast-start (LLDP-MED)

forwarding-class (VoIP)

interface (Access Control Service)

interface (Captive Portal)

interface (LLDP)

interface (LLDP-MED)

interface (Static MAC Bypass)

interface (VoIP)

interface-description-format

interval (Access Control Service)

lldp

lldp-configuration-notification-interval

lldp-med (Ethernet Switching)

nas-port-extended-format

password (Access Control Service)

port

port (Access Control Service)

port (RADIUS Server)

port (TACACS+ Server)

power-negotiation

profile

ptopo-configuration-maximum-hold-time

ptopo-configuration-trap-interval

quiet-period

quiet-period (Captive Portal)

radius (Access Profile)

retries (Captive Portal)

secure-authentication

server (RADIUS Accounting)

server (TACACS+ Accounting)

server-fail

server-reject-vlan

server-timeout

server-timeout (Captive Portal)

session-expiry

single-connection

source-address

source-address (NTP, RADIUS, System Logging, or TACACS+)

static (Protocols 802.1X)

timeout (Access Control Service)

timeout (RADIUS)

timeout-action (Access Control Service)

traceoptions (802.1X)

unified-access-control

update-interval

vlan-assignment

vlan-nas-port-stacked-format

voip

what

Routine Monitoring
Monitoring 802.1X Authentication Verifying 802.1X Authentication

Routine Monitoring

Monitoring 802.1X Authentication

Verifying 802.1X Authentication

Operational Commands
clear captive-portal clear dot1x clear lldp neighbors clear lldp statistics show captive-portal authentication-failed-users show captive-portal firewall show captive-portal interface show dot1x show dot1x authentication-failed-users show dot1x firewall show dot1x static-mac-address show ethernet-switching interfaces show lldp show lldp local-information show lldp neighbors show lldp remote-global-statistics show lldp statistics show network-access aaa statistics accounting show network-access aaa statistics authentication show network-access aaa statistics dynamic-requests show services unified-access-control authentication-table show services unified-access-control policies show services unified-access-control status

Operational Commands

clear captive-portal

clear dot1x

clear lldp neighbors

clear lldp statistics

show captive-portal authentication-failed-users

show captive-portal firewall

show captive-portal interface

show dot1x

show dot1x authentication-failed-users

show dot1x firewall

show dot1x static-mac-address