Users Guide

308 Authentication, Authorization, and Accounting
• NAS-Port (IETF attribute #5)
• Framed-IP-Address (IETF attribute #8)
• Calling-Station-ID (IETF attribute #31)
• Acct-Session-ID (IETF attribute #44)
• Message-Authenticator (IETF attribute #80)
• Error-Cause (IETF attribute #101)
A CoA NAK message is not sent for all CoA requests with a key mismatch.
The message is sent only for the first three requests for a client. After that, all
the packets from that client are dropped. When there is a key mismatch, the
response authenticator sent with the CoA NAK message is calculated from a
dummy key value.
The Dell EMC Networking N-Series switch will start listening to the 802.1X
client again based on the re-authentication timer.
RADIUS COA Example
The following example configures the Dell EMC Networking N-Series switch
to listen for and respond to RADIUS COA messages. This example does not
configure any ports to use 802.1X or enable 802.1X. See "IEEE 802.1X" on
page 318 for information on configuring 802.1X on interfaces.
1 Configure the switch to use the new model CLI command set. Dell EMC
Networking N-Series switches do not support old model commands:
console#config
console(config)#aaa new-model
2 Configure the switch to listen to RADIUS CoA requests.
console(config)#aaa server radius dynamic-author
3 Configure a local RADIUS client connection to RADIUS server
10.11.12.13 using the shared secret “secret sauce”. The default port
number is used.
console(config-radius-da)#client 10.11.12.13 server-key
“secret sauce”
4 Disconnect-request client identification must match on all keys present in
the request.
console(config-radius-da)#auth-type all
console(config-radius-da)#exit