RS is enabled globally on the distribution-tier switch. It is also enabled on the distribution-tier switch ports directly attached to the edge switch that the RADIUS request frames transit, from the edge switch to the RADIUS server, as well as the ports the response frames transit, from the RADIUS server back to the edge switch.
The number of seconds the firmware waits for a RADIUS response after it successfully snoops a RADIUS request can be set per-port. If you do not set this timeout at the port level, the system level setting is used.
In some cases it may be necessary to drop RADIUS traffic between the distribution tier device and the edge switches. On the S- and K-Series, you can enable or disable packet drop on a per port basis. Packets are always dropped for a resource issue situation. RS is not capable of forcing a reauthentication event should it be unable to investigate a RADIUS request exchange. Dropping a RADIUS request packet due to resource exhaustion, in most cases, will cause the edge device to retry a RADIUS request, providing another opportunity to snoop the RADIUS exchange. Frames with an invalid format for the calling station ID are only dropped when drop is enabled. In the case of dropping frames with an invalid format, authentication will not take place for this end-user.
The authallocated value specifies the maximum number of RS users per port. You can configure this number of allowed RS users on a per port basis. On the S- and K-Series, the default value depends upon the system license for this device. You should set this authallocated value equal to or less than the configured value for the set multiauth port numusers command. This value is the maximum number of users per port for all authentication clients. Typically, authallocated and multiauth port numusers are set to the same value.
Print
this page
Email this topic
Feedback
View PDF
Download EPUB