Authentication override allows you to override port authentication using a profile-based attribute. If a port has an active policy and the authentication override is enabled, all frames arriving on that port have that policy applied, and no further authentication occurs. In addition, any pre-existing authenticated sessions on that port are removed. However, the action is reverted once the authentication override is disabled. Authentication override is disabled by default.
The ENTERASYS-POLICY-PROFILE-MIB is changed to support the policy profile-based port authentication override feature:
Print
this page
Email this topic
Feedback
View PDF
Download EPUBetsysPolicyProfilePortAuthOverride OBJECT-TYPE
SYNTAX EnabledStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"If a port has an active policy and that policy's etsysPolicyProfilePortAuthOverride is set to enabled(1),
all frames arriving on the port will have that policy applied. In addition, any pre-existing entries with matching
port values in the etsysMultiAuthSessionStationTable tables will change their authorization status to
authTerminated(5). No further authentication will occur on this port.
If disabled(2), the actions described above will not occur."
DEFVAL { disabled }
::= { etsysPolicyProfileEntry 21 }
etsysPolicyClassification group
supportsProfilePortAuthOverride(24)
-- supports per profile port authentication
-- override via etsysPolicyProfilePortAuthOverride
To configure authentication override, use the following command:
configure policy profile profile_index {name name} {pvid pvid} {pvid-status pvid_status} {cos cos} {cos-status cos_status} {egress-vlans egress_vlan_list}{forbidden-vlans forbidden_vlans} {untagged-vlans untagged_vlans} {append | clear} {tci-overwrite tci_overwrite} {auth-override auth_override} {nsi [nsi | none]} {web-redirect web_redir_index}
Note
If authentication override is enabled, then static VLAN (Virtual LAN) has to be configured rather than using the dynamic VLAN for the PVID.