Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Navigation
Guide That Contains This Content
[+] Expand All
[-] Collapse All

    Configuring RADIUS Return Attributes Policies (NSM Procedure)

    You can configure RADIUS attributes policies on the Infranet Controller to send return list attributes to an 802.1X network access device. You can also configure other functions on a network access device's port based on the role assigned to the user who is currently using that port.

    To configure RADIUS attributes policies:

    1. In the NSM navigation tree, select Device Manager > Devices.
    2. Click the Device Tree tab, and then double-click the Infranet Controller device for which you want to configure RADIUS return attributes policies.
    3. Click the Configuration tab. In the configuration tree, select UAC > Network Access > RADIUS Attributes > RADIUS Return Attributes Policies.
    4. Add or modify RADIUS return attributes policies as specified in Table 1.
    5. Click one:
      • OK—Saves the changes.
      • Cancel—Cancels the modifications.

    Table 1: RADIUS Return Attributes Policies Configuration Details

    Option

    Function

    Your Action

    Name

    Specifies a name for the RADIUS return attribute policy.

    Enter a name for the RADIUS return attribute policy.

    Description

    Describes the RADIUS return attribute policy.

    Enter a brief description for the RADIUS return attribute policy.

    Location Group

    Specifies the location groups for the RADIUS attributes policies.

    Select the location group from the Non-member list and click Add to move them to the Members list.

    Note: To apply the policy to all location groups, do not add any location groups and leave the default setting (all) listed in the Selected Location Groups list.

    Enable Open port

    Disables assigning endpoints to a VLAN or returning any RADIUS attributes.

    Select this option to disable all other RADIUS attributes options.

    Enable VLAN

    Enables VLAN assignment according to RFC 3580 by returning the RADIUS tunnel attributes to the network access device.

    Select this option to configure VLAN assignment.

    Note: Selecting this option is equivalent to manually specifying the three RFC 3580 RADIUS tunnel attributes in the Enable Return Attribute section.

    VLAN

    Specifies the existing VLAN ID on the network infrastructure that you want to use for the role(s) to which this policy applies.

    Specify the existing VLAN ID.

    Enable Return Attribute

    Enables the return-attribute option.

    Select this option to enable return attributes.

    return-attribute

    Specifies the return attributes to be sent to the network access device.

    Click return-attribute and add the return attribute.

    1. From the Attribute drop-down list, select the return attribute you want to send.
    2. For Value, enter the value for the selected attribute, and then click OK.

    Enable addition of Session-Timeout attribute with value equal to the Session Lifetime

    Sends the Infranet Controller a session timeout value equal to the timeout value of the configured session length on all RADIUS accepts.

    Clear this check box to prevent the Infranet Controller from sending a session timeout value equal to the timeout value of the configured session length on all RADIUS accepts. This allows you to set the reauthentication timer statically on the switch port, if required

    Interface

    Specifies the Infranet Controller network interface for use by endpoints using RADIUS attributes policies to connect to the Infranet Controller.

    • Select Automatic to use VLAN tagging . You must also connect the Infranet Controller internal interface to the trunk port on a VLAN-enabled switch that sees all of the VLAN traffic.
    • Select Internal if the endpoints using RADIUS attributes policies should use the IP address of the Infranet Controller's internal interface.
    • Select External if the endpoints on the configured VLAN should use the IP address of the Infranet Controller's external interface.

    Applies to Roles

    Specifies the roles to which the policies apply.

    • Select Policy applies to ALL roles to apply this policy to all users.
    • Select Policy applies to SELECTED roles to apply this policy only to users who are mapped to roles in the Members list.
    • Select Policy applies to all roles OTHER those selected to apply this policy to all users except for those who map to the roles in the Members list.

    Role Selection

    Lists the members and non—members for applying the policy.

    Select the role from the Non-members list and click Add to move them to the Members list.

    Published: 2012-11-28