动态VLAN

miaolingzizhzu

一：通过VMPS实现
      交换机作为vmps server，连接tftp服务器（上面存储mac和vlan的对应信息。一个文本文件），其他的交换机为vmps client，连接vmps server和客户计算机，来进行信息请求。
To use VMPS, you first must create a VMPS database and store it on a TFTP server. The VMPS parser is line based. Start each entry in the file on a new line. The example at the end of this section corresponds to the information described below.
The VMPS database can have up to five sections:
Section 1, Global settings, lists the settings for the VMPS domain name, security mode, fallback VLAN, and the policy for VMPS and VTP domain name mismatches.
Begin the configuration file with the word "VMPS," to prevent other types of configuration files from incorrectly being read by the VMPS server.
Define the VMPS domain. The VMPS domain should correspond to the VTP domain name configured on the switch.
Define the security mode. VMPS can operate in open or secure mode. If you set it to open mode, VMPS returns an access denied response for an unauthorized MAC address and returns the fallback VLAN for a MAC address not listed in the VMPS database. In secure mode, VMPS shuts down the port for a MAC address that is unauthorized or that is not listed in the VMPS database.
(Optional) Define a fallback VLAN. Assign the fallback VLAN is assigned if the MAC addresses of the connected host is not defined in the database.
In the example at the end of this section, the VMPS domain name is WBU, the VMPS mode is set to open, the fallback VLAN is set to the VLAN default, and if the VTP domain name does match the VMPS domain name, then VMPS sends an access denied response message.
Section 2, MAC addresses, lists MAC addresses and authorized VLAN names for each MAC address.
Enter the MAC address of each host and the VLAN name to which each should belong.
Use the --NONE-- keyword as the VLAN name to deny the specified host network connectivity.
You can enter up to 21,051 MAC addresses in a VMPS database file for the Catalyst 2948G switch.
In the example at the end of this section, MAC addresses are listed in the MAC table. Notice that the MAC address fedc.ba98.7654 is set to --NONE--. This setting explicitly denies this MAC address from accessing the network.
Section 3, Port groups, lists groups of ports on various switches in your network that you want grouped together. You use these port groups when defining VLAN port policies.
Define a port group name for each port group; then list all ports you want included in the port group.
A port is identified by the IP address of the switch and the module/port number of the port in the form mod_num/port_num. Ranges are not allowed for the port numbers.
Use the all-ports keyword to specify all the ports in the specified switch.
The example at the end of this section has two port groups:
WiringCloset1 consists of the two ports: port 3/2 on the VMPS client 198.92.30.32 and port 2/8 on the VMPS client 172.20.26.141
Executive Row consists of three ports: port 1/2 and 1/3 on the VMPS client 198.4.254.222, and all ports on the VMPS client 198.4.254.223
Section 4, VLAN groups, lists groups of VLANs you want to associate together. You use these VLAN groups when defining VLAN port policies.
Define the VLAN group name; then list each VLAN name you want to include in the VLAN group.
You can enter a maximum of 256 VLANS in a VMPS database file for the Catalyst 2948G switch.
The example at the end of this section has the VLAN group Engineering, which consists of the VLANs hardware and software.
Section 5, VLAN port policies, lists the VLAN port policies, which use the port groups and VLAN groups to further restrict access to the network.
You can configure a restricted access using MAC addresses and the port groups or VLAN groups.
The example at the end of this section has three VLAN port policies specified.
In the first VLAN port policy, the VLAN hardware or software is restricted to port 3/2 on the VMPS client 198.92.30.32 and port 2/8 on the VMPS client 172.20.23.141.
In the second VLAN port policy, the devices specified in VLAN Green can connect only to port 4/8 on the VMPS client 198.92.30.32.
In the third VLAN port policy, the devices specified in VLAN Purple can connect to only port 1/2 on the VMPS client 198.4.254.22 and the ports specified in the port group Executive Row.
The following example shows a sample VMPS database configuration file.
!Section 1: GLOBAL SETTINGS
!VMPS File Format, version 1.1
! Always begin the configuration file with
! the word "VMPS"
!
!vmps domain
! The VMPS domain must be defined.
!vmps mode {open | secure}
! The default mode is open.
!vmps fallback
!vmps no-domain-req { allow | deny }
!
! The default value is allow.
vmps domain WBU
vmps mode open
vmps fallback default
vmps no-domain-req deny
!
!Section 2: MAC ADDRESSES
!MAC Addresses
vmps-mac-addrs
!
! address  vlan-name
!
address 0012.2233.4455 vlan-name hardware
address 0000.6509.a080 vlan-name hardware
address aabb.ccdd.eeff vlan-name Green
address 1223.5678.9abc vlan-name ExecStaff
address fedc.ba98.7654 vlan-name --NONE--
address fedc.ba23.1245 vlan-name Purple
!
!Section 3: PORT GROUPS
!Port Groups
!vmps-port-group
! device  { port  | all-ports }
!
vmps-port-group WiringCloset1
device 198.92.30.32 port 3/2
device 172.20.26.141 port 2/8
vmps-port-group "Executive Row"
device 198.4.254.222 port 1/2
device 198.4.254.222 port 1/3
device 198.4.254.223 all-ports
!
!Section 4: VLAN GROUPS
!VLAN groups
!
!vmps-vlan-group
! vlan-name
!
vmps-vlan-group Engineering
vlan-name hardware
vlan-name software
!
!Section 5: VLAN PORT POLICIES
!VLAN port Policies
!
!vmps-port-policies {vlan-name  | vlan-group  }
! { port-group  | device  port  }
!
vmps-port-policies vlan-group Engineering
ort-group WiringCloset1
vmps-port-policies vlan-name Green
device 198.92.30.32 port 4/8
vmps-port-policies vlan-name Purple
device 198.4.254.22 port 1/2
ort-group "Executive Row"
二：通过802.1x和ACS实现
设备环境：Cisco Catalyst 3550-24-EMI（IOS：12.1(14)EA1 EMI），Cisco Secure ACS v3.1
1、和802.1x相关的交换机主要配置内容：
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
!---如果只是做802.1x认证，则aaa authorization network这句可不要，如要做VLAN分配或per-user ACL，则必须做network authorization
dot1x system-auth-control
!---注意在12.1(14)EA1版以后802.1x的配置有了修改，此句enable 802.1x
interface FastEthernet0/1
description To Server_Farm
switchport mode access
dot1x port-control auto
dot1x max-req 3
spanning-tree portfast
!---dot1x port-control auto句在F0/1上enable dot1x，另外注意在F0/1口下我并没有给它赋VLAN
radius-server host 1.2.3.4 auth-port 1812 acct-port 1813 key radius_string
radius-server vsa send authentication
!---radius-server host 1.2.3.4句定义radius server信息，并给出验证字串
!---因为要配置VLAN分配必须使用IETF所规定的VSA(Vendor-specific attributes）值，radius-server vsa send authentication句允许交换机识别和使用这些VSA值。
配置802.1x动态分配VLAN所用到的VSA值规定如下：
[64] Tunnel-Type = VLAN
[65] Tunnel-Medium-Type = 802
[81] Tunnel-Private-Group-ID = VLAN name or VLAN ID
2、和802.1x相关的ACS主要配置内容：
这个配置要看图了，另外附带说一点，Cisco文档说ACS 3.0之前是不支持802.1x的。因为802.1x使用radius进行认证，所以在选用认证协议时我选用的是RADIUS(IETF)，而缺省是Cisco的TACACS+。
在Interface Configuration中对RADIUS(IETF)进行配置，在组用户属性中选中[64]Tunnel-Type、[65] Tunnel-Medium-Type、[81]Tunnel-Private-Group-ID（见下图）。
在Group Setup中对RADIUS Vendor-Specific Attributes值进行编辑：勾选[64]Tunnel-Type，将tag 1的值选为VLAN；勾选[65] Tunnel-Medium-Type，将tag 1的值选为802；勾选[81]Tunnel-Private-Group-ID，将tag 1的值设为7，表明为VLAN 7（见下图）。设置完后，Submit+Rest。
3、工作站端的设置：
WINXP本身内置对802.1x的支持，微软在前不久出了一个补丁可以让WIN2K也支持802.1x，需要注意的是WIN2K SP4已经内置了对802.1x的支持，SP3以下可使用此补丁：
http://support.microsoft.com/default...b;en-us;313664

安装完此补丁后，802.1x默认是不启动的，可在服务中手动打开Wireless Configuration服务，打开此服务后，在网卡连接属性中会多出一栏Authenticatioin，在此栏中勾选Enable network access control using IEEE 802.1x，同时在EAP type中选中MD5-Challenge。
4、测试：
在所有设置完成后，可以观察到802.1x enable的F0/1口上状态灯显示为黄灯，而在工作站端过一会后会弹出一个认证窗口，在用户名/口令处填入ACS中定义好的用户名/口令，域名处不填，同时观察WIN2K systray处的连接图标，上面会有和认证服务器联系及认证用户的浮动提示，同时F0/1的状态灯也会顺利变为绿灯。
认证通过后检验VLAN值是否已正确分配：先ping VLAN7的网关地址，通；再ping其它VLAN的网关地址，通；最后看可否上Internet，通。


本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u/23081/showart_232859.html