Configuring Match Statements on the RADIUS Server
You can configure simple filter conditions using the
Juniper-Switching-Filter
attribute in
the Juniper dictionary on the RADIUS server. These filters are then sent to a switch
whenever a new user is authenticated successfully. The filters are created and applied
on all EX Series switches that authenticate users through that RADIUS server without
the need to configure anything on each individual switch.
To configure the
Juniper-Switching-Filter
attribute, enter one or more match conditions
and a resulting action using the CLI for the RADIUS server. Enter the match statement
plus an action statement enclosed within quotes (" ") using the following syntax:
match <destination-mac mac-address> <source-vlan vlan-name> <source-dot1q-tag
tag> <destination-ip ip-address> <ip-protocol protocol-id> <source-port port>
<destination-port port>
}
action [allow | deny] <forwarding-class class-of-service> <loss-priority (low | medium
| high)>
}
See “VSA Match Conditions and Actions for EX Series Switches” on page 2626 for definitions
of match statement options.
To configure match conditions on the RADIUS server:
1.
Verify that the Juniper dictionary is loaded on your RADIUS server and includes the
filtering attribute
Juniper-Switching-Filter
, attribute ID 48:
[root@freeradius]#
cat /usr/local/share/freeradius/dictionary.juniper
# dictionary.juniper
#
# Version: $Id: dictionary.juniper,v 1.2.6.1 2005/11/30 22:17:25
aland Exp
$
# VENDOR Juniper 2636
BEGIN-VENDOR Juniper
ATTRIBUTE Juniper-Local-User-Name 1 string
ATTRIBUTE Juniper-Allow-Commands 2 string
ATTRIBUTE Juniper-Deny-Commands 3 string
ATTRIBUTE Juniper-Allow-Configuration 4 string
ATTRIBUTE Juniper-Deny-Configuration 5 string
ATTRIBUTE Juniper-Switching-Filter 48 string
<—
2.
Enter the match conditions and actions. For example:
•
To deny authentication based on the 802.1Q tag (here, the 802.1Q tag is
10
):
[root@freeradius]#
cd /usr/local/etc/raddb
vi users
For each relevant user, add the
Juniper-Switching-Filter
attribute:
Juniper-Switching-Filter = "match source-dot1q-tag 10 action deny"
2619
Copyright © 2010, Juniper Networks, Inc.
Chapter 83: Configuring Access Control
Summary of Contents for JUNOS OS 10.3 - SOFTWARE
Page 325: ...CHAPTER 17 Operational Mode Commands for System Setup 229 Copyright 2010 Juniper Networks Inc ...
Page 1323: ...CHAPTER 56 Operational Mode Commands for Interfaces 1227 Copyright 2010 Juniper Networks Inc ...
Page 2841: ...CHAPTER 86 Operational Commands for 802 1X 2745 Copyright 2010 Juniper Networks Inc ...
Page 3367: ...CHAPTER 113 Operational Mode Commands for CoS 3271 Copyright 2010 Juniper Networks Inc ...
Page 3435: ...CHAPTER 120 Operational Mode Commands for PoE 3339 Copyright 2010 Juniper Networks Inc ...
Page 3529: ...CHAPTER 126 Operational Mode Commands for MPLS 3433 Copyright 2010 Juniper Networks Inc ...
