To use Extreme Networks VSAs with the Internet Authentication Service
(IAS) in Microsoft® Windows Server™ 2003, you must first create a Remote Access Policy and
apply it so that user authentication occurs using a specific authentication type such as
EAP-TLS, PEAP, or PAP. The following procedure assumes that the Remote Access Policy has
already been created and configured and describes how to define Extreme Networks VSAs in
Open the IAS administration GUI application.
In the left window pane, select the Remote
Access Policies section of the tree.
In the right window pane, double-click the desired Remote-Access
policy name so you can edit it.
Click the Edit-Profile button
in the lower-left corner, and then select the Advanced tab.
If any attributes already appear in the
Parameters window, remove them by selecting the attribute and
clicking the Remove button.
When the Parameters window is empty,
proceed to the next step.
Click the Add button, which brings up the Add Attributes dialog
Scroll down the displayed list of RADIUS attributes and select the attribute named Vendor-Specific.
Double-click the Vendor-Specific attribute
or click the Add button.
The Multivalued Attribute Information dialog
box should appear.
Click the Add button, which brings
up the Vendor-Specific Attribute Information dialog window.
Select the first radio button for Enter Vendor Code and enter the
Extreme Networks vendor code value of 1916 in the
Select the second radio button for Yes,
Verify both settings, and click the Configure
Attribute button to proceed.
The Configure VSA (RFC compliant) dialog
window should now appear.
The settings for this dialog window varies, depending on which
product and attribute you wish to use in your network.
In the first text-box enter the Extreme Networks VSA
number for the attribute you want to configure (see Extreme Networks VSAs).
Use the pull-down menu to select the
Attribute format, which is the same as the attribute Type
listed in Extreme Networks VSAs.
For values of format integer you will have to
select the type Decimal
from the pull-down menu.
Configure the desired value for the attribute.
Once the desired values have been entered, click
Click OK two more times to return to the Add Attributes
Select Close, and then click OK twice
to complete the editing of the Remote Access Policy profile.
To apply the configuration changes, stop and restart
the Microsoft IAS service.
After restarting the IAS service, new authentications should
correctly return the Extreme Networks VSA after successful authentication.
Users who were previously authenticated have to re-authenticate
to before the new VSAs apply to them.
If you experience problems with the newly configured
VSAs, use the following troubleshooting guidelines:
If you have multiple IAS Remote Access Policies,
verify that the user is being authenticated with the correct policy.
Check the IAS System Log events within Microsoft Event
Viewer to verify the user is authenticated through the policy where
VSA settings are configured.
Check whether the VSA configuration performed above
A mismatch in any of the VSA settings could cause authentication
or VSA failure.
Verify that attributes such as "VLAN tag" or "VLAN name" correctly match the configuration of your
ExtremeXOS switch and overall network topology.
Invalid, or incorrect values returned in the VSA could prevent
authenticated users from accessing network resources.