Web-Based Network Login Configuration Example
The following configuration example shows both the Extreme Networks switch configuration and the RADIUS server entries needed to support the example.
- ISP Mode—Network login clients connected to ports 1:10–1:14, VLAN corp, will be logged into the network in ISP mode. This is controlled by the fact that the VLAN in which they reside in unauthenticated mode and the RADIUS server Vendor Specific Attributes (VSA), Extreme-Netlogin-Vlan, are the same, corp. So there will be no port movement. Also if this VSA is missing from RADIUS server, it is assumed to be ISP Mode.
- Campus Mode—On the other hand, clients connected to ports 4:1–4:4, VLAN temp, will be logged into the network in Campus mode since the port will move to the VLAN corp after getting authenticated. A port moves back and forth from one VLAN to the other as its authentication state changes.
Both ISP and Campus mode are not tied to ports but to a user profile. In other words, if the VSA Extreme:Extreme-Netlogin-Vlan represents a VLAN different from the one in which the user currently resides, then VLAN movement will occur after login and after logout. In following example, it is assumed that campus users are connected to ports 4:1–4:4, while ISP users are logged in through ports 1:10–1:14.
NoteIn the following sample configuration, any lines marked (Default) represent default settings and do not need to be explicitly configured.
create vlan “temp” create vlan “corp” configure vlan “default” delete ports 4:1-4:4 enable ipforwarding # Configuration Information for VLAN temp # No VLAN-ID is associated with VLAN temp. configure vlan “temp” ipaddress 18.104.22.168 255.255.255.0 # Configuration Information for VLAN corp # No VLAN-ID is associated with VLAN corp. configure vlan “corp” ipaddress 10.203.0.224 255.255.255.0 configure vlan “corp” add port 1:10 untagged configure vlan “corp” add port 1:11 untagged configure vlan “corp” add port 1:12 untagged configure vlan “corp” add port 1:13 untagged configure vlan “corp” add port 1:14 untagged # Network Login Configuration configure vlan “temp” dhcp-address-range 22.214.171.124 - 126.96.36.199 configure vlan “temp” dhcp-options default-gateway 188.8.131.52 configure vlan “temp” dhcp-options dns-server 184.108.40.206 configure vlan “temp” dhcp-options wins-server 10.0.1.85 configure netlogin vlan “temp” enable netlogin web-based enable netlogin ports 1:10-1:14,4:1-4:4 web-based configure netlogin base-url "network-access.com" (Default) configure netlogin redirect-page http://www.extremenetworks.com (Default) enable netlogin logout-privilege (Default) disable netlogin session-refresh 3 (Default) # DNS Client Configuration configure dns-client add name-server 10.0.1.1 configure dns-client add name-server 10.0.1.85 #RADIUS Client Configuration configure radius netlogin primary server 10.0.1.2 1812 client-ip 10.10.20.30 vr “Vr-Mgmt” configure radius netlogin primary shared-secret purple enable radius
For this example, the following lines (for a FreeRADIUS server) should be added to the RADIUS server users file for each user:
Extreme:Extreme-Netlogin-Only = Enabled (if no CLI authorization) Extreme:Extreme-Netlogin-Vlan = "corp" (destination vlan for CAMPUS mode network login)
NoteFor information about how to use and configure your RADIUS server, refer to Configuring the RADIUS Client and the documentation that came with your RADIUS server.