User manual ALCATEL-LUCENT OMNISTACK LS 6200

[. . . ] D June 2007 Alcatel OS-LS-6200 User Guide www. alcatel. com An Alcatel service agreement brings your company the assurance of 7x24 no-excuses technical support. You'll also receive regular software updates to maintain and maximize your Alcatel product's features and functionality and on-site hardware replacement through our global network of highly qualified service delivery partners. Additionally, with 24-hour-a-day access to Alcatel's Service and Support web page, you'll be able to view and update any case (open or closed) that you have reported to Alcatel's technical support, open a new case or access helpful release notes, technical bulletins, and manuals. For more information on Alcatel's Service Programs, see our web page at www. ind. alcatel. com, call us at 1-800-995-2696, or email us at support@ind. alcatel. com. This Manual documents Alcatel 6200 hardware and software. [. . . ] To disabled access to the VLAN, use the no form of this command. Mode ICE PE PE PE ICV Page 4-273 4-274 4-277 4-279 4-281 4-282 4-283 show dot1x statistics Displays 802. 1X statistics for the specified interface. dot1x multiple-hosts Enables multiple hosts (clients) on an 802. 1X-authorized port, ICE where the authorization state of the port is set to auto. To return to the default configuration, use the no form of this command dot1x Configures the action to be taken, when a station whose MAC single-host-violation address is not the supplicant MAC address, attempts to access the interface. dot1x guest-vlan dot1x guest-vlan enable dot1x mac-authentication show dot1x advanced ICE Defines a guest VLAN. To return to the default configuration, use ICV the no form of this command. Enables unauthorized users on the interface access to the Guest ICE VLAN. Enables authentication based on the station's MAC address Displays 802. 1X advanced features for the device or specified interface ICE PE 4-284 4-285 4-285 4-286 aaa authentication dot1x The aaa authentication dot1x Global Configuration mode command specifies one or more authentication, authorization, and accounting (AAA) methods for use on interfaces running IEEE 802. 1X. To return to the default configuration, use the no form of this command. Syntax aaa authentication dot1x default method1 [method2. . . ] no aaa authentication dot1x default Parameters · method1 [method2. . . ] -- At least one from the following table: Keyword Radius None Description Uses the list of all RADIUS servers for authentication Uses no authentication 264 802. 1x Commands Default Setting No authentication method is defined. Command Mode Global Configuration 4 Command Usage Additional methods of authentication are used only if the previous method returns an error and not if the request for authentication is denied. To ensure that authentication succeeds even if all methods return an error, specify none as the final method in the command line. Example The following example uses the aaa authentication dot1x default command with no authentication. Console(config)# aaa authentication dot1x default none Related Commands aaa authentication enable dot1x system-auth-control The dot1x system-auth-control Global Configuration mode command enables 802. 1x globally. To return to the default configuration, use the no form of this command. Syntax dot1x system-auth-control no dot1x system-auth-control Default Configuration 802. 1x is disabled globally. Command Modes Global Configuration mode Command Usage There are no user guidelines for this command. Examples The following example enables 802. 1x globally. Console(config)# dot1x system-auth-control Related Commands dot1x re-authentication 265 4 Command Line Interface dot1x timeout re-authperiod dot1x timeout quiet-period dot1x timeout tx-period dot1x max-req dot1x timeout supp-timeout dot1x timeout server-timeout show dot1x show dot1x users dot1x port-control The dot1x port-control Interface Configuration mode command enables manually controlling the authorization state of the port. To return to the default configuration, use the no form of this command. Syntax dot1x port-control {auto | force-authorized | force-unauthorized} no dot1x port-control Parameters · auto -- Enables 802. 1X authentication on the interface and causes the port to transition to the authorized or unauthorized state based on the 802. 1X authentication exchange between the port and the client. · force-authorized -- Disables 802. 1X authentication on the interface and causes the port to transition to the authorized state without any authentication exchange required. The port resends and receives normal traffic without 802. 1X-based authentication of the client. · force-unauthorized -- Denies all access through this interface by forcing the port to transition to the unauthorized state and ignoring all attempts by the client to authenticate. The device cannot provide authentication services to the client through the interface. Default Configuration Port is in the force-authorized state Command Mode Interface Configuration (Ethernet) Command Usage It is recommended to disable spanning tree or to enable spanning-tree PortFast mode on 802. 1x edge ports (ports in auto state that are connected to end stations), in order to get immediately to the forwarding state after successful authentication. 266 802. 1x Commands Example The following example enables 802. 1X authentication on Ethernet port 1/e16. Console(config)# interface ethernet 1/e16 Console(config-if)# dot1x port-control auto 4 Related Commands dot1x re-authentication dot1x timeout re-authperiod dot1x timeout quiet-period dot1x timeout tx-period dot1x max-req dot1x timeout supp-timeout dot1x timeout server-timeout show dot1x show dot1x users dot1x re-authentication The dot1x re-authentication Interface Configuration mode command enables periodic re-authentication of the client. [. . . ] Formerly called Group Address Registration Protocol. Generic Multicast Registration Protocol (GMRP) GMRP allows network devices to register end stations with multicast groups. GMRP requires that any participating network devices or end stations comply with the IEEE 802. 1p standard. Group Attribute Registration Protocol (GARP) See Generic Attribute Registration Protocol. IEEE 802. 1D Specifies a general method for the operation of MAC bridges, including the Spanning Tree Protocol. IEEE 802. 1Q VLAN Tagging--Defines Ethernet frame tags which carry VLAN information. It allows switches to assign endstations to different virtual LANs, and defines a standard way for VLANs to communicate across switched networks. IEEE 802. 1p An IEEE standard for providing quality of service (QoS) in Ethernet networks. The standard uses packet tags that define up to eight traffic classes and allows switches to transmit packets based on the tagged priority value. IEEE 802. 1s An IEEE standard for the Multiple Spanning Tree Protocol (MSTP) which provides independent spanning trees for VLAN groups. IEEE 802. 1x Port Authentication controls access to the switch ports by requiring users to first enter a user ID and password for authentication. IEEE 802. 3ac Defines frame extensions for VLAN tagging. 728 IEEE 802. 3x Defines Ethernet frame start/stop requests and timers used for flow control on full-duplex links. IGMP Snooping Listening to IGMP Query and IGMP Report packets transferred between IP Multicast Routers and IP Multicast host groups to identify IP Multicast group members. IGMP Query On each subnetwork, one IGMP-capable device will act as the querier -- that is, the device that asks all hosts to report on the IP multicast groups they wish to join or to which they already belong. [. . . ]