Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Dynamic Activation of VLANs with 802.1X

When you enable dynamic activation of VLANs with 802.1x in an EVPN-VXLAN network, Junos creates the VLANs locally in a deactivated state. When a client connects to the port, Junos sends an authentication request to a server (such as a RADIUS server) and only upon successful authentication will Junos activates the assigned VLAN.

Benefits of Dynamic Activation of VLANs with 802.1X

  • Optimize resource utilization by ensuring VLANS are installed in hardware only when actively required.

  • Increase scalability in EVPN-VXLAN deployments by preventing large numbers of unused, preconfigured VLANs from being installed in hardware.

  • Reduce the programming of unnecessary host routes for all preconfigured VLANs.

When you enable dynamic activation of VLANs with 802.1X in an EVPN-VXLAN network, Junos creates the VLANS locally in a deactivated state. When a client initiates a connection on the local port, Junos sends an authentication request to the authentication server, such as a RADIUS server. Upon successful authentication completion, the authentication server assigns the VLAN and a Vendor-Specific Attribute (VSA) to the device. The Junos device then associates the interface with the VLAN, activates the VLAN, and programs the host routes for the VLAN into the PFE.

Junos devices accept the following VSA:

  • Tunnel-private-Group-ID

  • Egress-VLAN-ID

  • Juniper-VoIP-VLAN

To enable dynamic activation of VLANs with 802.1X, use set vlans vlan-name activate-on-local-ports or set routing-instances routing-instance-name vlans vlan-name activate-on-local-ports

For example:

Note: Junos devices configured for EVPN Type 5 routing must enable host route suppression by including the set protocols evpn suppress-remote-host-routes-on-vlan-down< statement. This ensures that Type 5 host routes are not created in the PFE and host routes are not advertised when the VLANS are not active.

Use the show vlans vlan-name extensive command to display the current status of a VLAN. The following sample shows the status of an activated and deactivated VLANs when the Activate-on-local-ports is enabled. The activated VLAN also shows the associated interface.

Clearing VLANs from the PFE

When a VLAN becomes inactive or gets disconnected, a 5-minute idle timer starts. If there is no further activity on the VLAN or the client does not reauthenticate before the timer expires, the Junos device removes the VLAN and associated bridge domain from the PFE and withdraws the related host routes. You can override this waiting period and force immediate cleanup by deactivating all VLANS. Use the clear dot1x dynamic-vlan command.

Related Documentation