Multi-Switch Link Aggregation Group (MLAG) Support for Change of Authentication (CoA)

Starring with ExtremeXOS 30.4, MLAG support for Network Login (Netlogin) is extended for dynamic authorization and disconnect (CoA). CoA support (introduced in ExtremeXOS 22.1), which was implemented directly in the policy module now moves to NetLogin.

The CoA messages that were previously handled directly by the policy module are now handled by the NetLogin module. With ExtremeXOS 30.4, the AAA module, on receiving the CoA messages from the RADIUS server, passes the data to NetLogin. Netlogin checks for the availability of the client, and the mode of authentication. If it finds a valid client, the CoA message is passed to policy for further processing. Additionally, NetLogin takes care of updating the MLAG peer about the dynamic authorization changes or disconnect. The NetLogin module on the MLAG peer passes the message to the policy module of that switch.

Supported Platforms

Summit X450-G2, X460-G2, X670-G2, and ExtremeSwitching X440-G2, X465, X590, X620, X690, X870 series switches.

Limitations

• CoA support is not provided for web-based clients.
• The CoA server is aware of only the MLAG authenticator, so if the ISC link is down, one MLAG peer may have a client in a different profile with respect to the other MLAG node. This is resolved after the ISC link becomes active. This is a limitation of the CoA server.