Configure Dynamic VLAN Assignment Using 802.1X Authentication

Configure a RADIUS Server

1. In Director view:
   1. Select the Configuration tab in the top menu bar.
   2. Select Devices > Devices in the horizontal menu bar.
   3. Select a device name in the main panel. The view changes to Appliance view.
2. Select Others > Organization > RADIUS Servers in the left menu bar.
   
   
    
3. Click the  Add icon. In the Add RADIUS Servers popup window, enter information for the following fields.
   
   
    

   Field	Description
   Name (Required)	Enter a name for the RADIUS server.
   Description	Enter a description for the RADIUS server.
   IP Address (Required)	Enter the IP address of RADIUS server.
   Port (Required)	Enter the port to connect to on the RADIUS server.
   Routing Instance	Select a routing instance to use to reach the RADIUS server.
   Shared Secret (Required)	Enter the shared secret password for the RADIUS server.

4. Click OK.

Configure an Authentication Profile

1. In Director view:
   1. Select the Configuration tab in the top menu bar.
   2. Select Devices > Devices in the horizontal menu bar.
   3. Select a device name in the main panel. The view changes to Appliance view.
2. Select Others > Organization > Authentication Profile in the left menu bar.
   
   
    
3. Click the  Add icon. In the Add Authentication Profile popup window, select the General tab and enter information for the following fields.
   
   
    

   Field	Description
   Name (Required)	Enter a name for the authentication profile.
   Type (Required)	Select an authentication type: Local RADIUS
   Description	Enter a description for the local or RADIUS server.
   Trusted Certificate Database (Required)	For local authentication type, select the trusted certificate database to use to verify and confirm the authority of the server certificate.
   Certificate (Required)	For local authentiction type, select a certificate to use to authenticate the server.
   Radius Server (Required)	Click the  Add icon, and then select the RADIUS server. To add a new RADIUS server, click + New RADIUS Server. See Configure a RADIUS Server.

4. Click OK.

Configure Dynamic VLAN Assignment

To dynamically assign VLANs to bridge access ports using the 802.1X device authentication flow:

1. In Director view:
   1. Select the Administration tab in the top menu bar.
   2. Select the Appliances in the left menu bar.
   3. Select a device name in the main panel. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Others > Organization > dot1x > Authentication Control in the left menu bar, and then select the dot1x tab in the horizontal menu bar.
   
   
    
4. Click the Edit icon. In the dot1x popup window, enter information for the following fields.
   
   
    

   Field	Description
   Authentication Profile (Required)	Select an authentication profile.
   Interface Name (Required)	Select an interface name.
   Quiet Period	Enter how long the interface waits after a failed authentication attempt before trying to authenticate a user again. Range: 0 through 600 seconds Default: None
   No Reauthentication	Click to disable periodic reauthentication of users.
   Reauthentication Interval	Enter the interval at which to reauthenticate the user. By default, a user is reauthenticated at each configured interval. <Range: 10 through 86400 seconds Default: None
   Retries	Enter how many times to try to authenticate the port after an initial failure. The port remains in a wait state during the quiet period after the authentication attempt. Range: 1 through 10 Default: 2
   Role	Select the interface role: Authenticator—Interface acts as the authenticator Supplicant—Interface acts as a supplicant Default: None
   Supplicant	Select the type of supplicant: Multiple—Allow multiple end devices to connect to the port. Each end device is authenticated individually. Multiple mode is supported only on bridge interfaces in trunk mode. Single—Authenticate only the first end device. All other end devices that connect to the port later are allowed access without any further authentication. The subsequent devices effectively piggyback on the first end device’s authentication. Single-secure—Allow only one end device to connect to the port at a time. No other end device can connect until the first device logs out. Default: None
   Enable Dynamic VLAN	Click to enable dynamic VLANs.
   Enable RADIUS Dynamic VLAN	Click to enable RADIUS dynamic VLANs.
   Auth Default VLAN ID	Enter the ID for the default VLAN. Range: 0 through 4094 Default: None
   Guest VLAN ID	Enter the ID for the guest VLAN. Range: 0 through 4094 Default: None
   Add Icon	Click to add the interface to the 802.1X profile.

5. Click OK.