How to restrict authentication attempts from restrict VLAN

Publication Date:  2016-08-28 Views:  237 Downloads:  0
Issue Description

Let's consider this scenario:

S2750 with V200R006 or later software release configured with 802.1x authentication on access ports. We have 3 VLANs,

VLAN A it's use for RADIUS LDAP communication.

VLAN B it's the network VLAN on which user gets after it pass dot1x authentication successfully.

VLAN C it's the restrict VLAN on which user gets after dot1x authentication fails.


The requirement:

After user fails authentication and gets into restrict VLAN, switch should not allow the user to try authentication again even if it will use the correct credentials to perform authentication.

Configuration example:

>> interface Ethernet0/0/10
>>    port link-type hybrid
>>    port hybrid pvid vlan A
>>    port hybrid untagged vlan A B C
>>    dot1x enable
>>    dot1x max-user 2
>>    authentication restrict-vlan C
>>    dot1x reauthenticate
>>    dot1x authentication-method eap


Solution

With other words, the requirement is to filter the EAP requests coming from restrict VLAN.

The easiest way to achieve this is to configure a classifier that match the EAP request parameters for vlan 400 and blacklist the packets that match the ACL rule. Check below:

> acl number 4000
> rule 5 permit l2-protocol 0x888e vlan-id 400
>  
> cpu-defend policy YYYY
> blacklist 1 acl 4000
>  
> cpu-defend-policy YYYY global

this configure with forbid switch to process any EAP requests coming from restrict VLAN.

END