Some scenarios require certain end devices to always enter a specific VLAN, regardless of which switch port the devices are connected to. This can be achieved through RADIUS authentication, where the RADIUS user is assigned to a specific VLAN (dynamic VLAN).
This article describes how to set up dynamic VLAN on a switch of the XS-51xx / XS-6xxx and GS-45xx series.
1) Configuring the RADIUS server on the LANCOM router:
1.1) In LANconfig, open the configuration for the router, navigate to the menu RADIUS → Server and set a checkmark next to RADIUS authentication active.
1.2) Navigate to the menu RADIUS services ports.
1.3) Check that the authentication port is set to 1812.
1.4) Go to the IPv4 clients menu.
1.5) Create a new entry and enter the following parameters:
1.6) Go to the User table menu.
1.7) Create a new entry and adjust the following parameters:
Repeat this step for additional users. The service type call check is only supported as of LCOS 10.30. |
1.8) This concludes the configuration of the RADIUS server on the LANCOM router. You can now write the configuration back to the device.
2) Configuring the RADIUS authenticator on the switch:
2.1) Connect to the web interface of the device and navigate to the menu System → AAA → Authentication List.
2.2) Select the entry dot1xList and then click Edit.
2.3) Under Available Methods select the option Radius and click the upper “arrow” icon to move it into the Selected Methods. Then click Submit.
The option Radius must be stored here, otherwise the switch will not forward the RADIUS requests to the RADIUS server. |
2.4) Go to the menu Security → RADIUS → Named Server.
2.5) Click Add to add a RADIUS server.
2.6) Modify the following parameters and then click Submit:
2.7) Go to the menu Security → Authentication Manager → Interface Configuration.
At this point, under no circumstances should the Admin Mode under Security → Authentication Manager → Configuration be activated (Enable), because authentication is enabled globally for all ports. Otherwise, configuration access to the switch is no longer possible! |
The status of the Named Server under Current only changes to True when the switch receives a RADIUS request.
|
2.8) Select the interface used for configuration access (in this example the port 1/0/1, which the router is also connected to), under Control Mode select the option Force Authorized and click Submit. With this setting, no authentication is performed on this port.
2.9) Select a port on which authentication should be performed (in this example 1/0/10), adjust the following parameters and click Submit:
2.10) On the Configuration tab, set the Admin Mode to the option Enable and click Submit.
2.11) Click on Save Configuration in the top right-hand corner to save the configuration as the start configuration.
The start configuration is retained even if the device is restarted or there is a power failure. As an alternative, the current configuration can be saved as the Start Configuration from the command line with the command write memory. |
2.12) Confirm your changes by clicking OK.
