The following document provides steps for configuring a Dell switch for dynamic-VLAN-based enforcement with MetaAccess NAC.
In this use case above, the Dell N-Series switch is configured to authenticate against the SafeConnect RADIUS Server. Since MAC authentication is also supported, no supplicant configuration is required on the end user wired device. However, 802.1X for managed devices is also supported.
For Managed devices connecting to the switch, 802.1X authentication will be performed. After authentication takes place, the SafeConnect RADIUS server will dynamically assign the Managed device the appropriate level of access. This is achieved by leveraging VLAN/Filter-Id RADIUS attributes and Dynamic VLAN/ACL Assignment on the NSeries switch.
For unmanaged devices connecting to the switch port, MAC authentication is performed. The MAC authentication will initially place the user in the Quarantine VLAN for Captive Portal user authentication to capture identity. Policy Based Routing (PBR) configuration on the Dell Layer 3 switch (N-Series or S-Series) or Dell SonicWall will redirect traffic received in the Quarantine VLAN to SafeConnect. After authentication a RADIUS Change of Authorization (CoA) will be sent from the SafeConnect RADIUS server to the N-Series Layer 2 switch and the user will be placed in the Guest VLAN/ACL.
Configuration:
The following configuration commands are not intended to comprise the entire configuration needed for a fully functional access switch but contain the key configurations needed to enable the features described in this document. The commands below assume that the switch is fully functional and all production VLANs and the quarantine VLAN haves already been configured. It is recommended that the integration is verified on a test VLAN/port before applying configurations to a production VLAN/port(s).
Configuring a Dell S-Series (OS9) Layer 2 switch
Example - SafeConnect VM is <NAC-IP>, VLAN ID is <VLAN-ID>
Configuring the Dell S-Series (OS9) Layer 3 Switch Quarantine VLAN Redirect
NOTE – This script includes CAM configuration for PBR which requires a switch reload. In order for PBR to function properly, a switch reload must be performed. NOTE - The be sure to delete the CAM configuration not required for your model.
