AMIGOPOD PowerConnect W Clearpass 100 Software Installation guide

amigopod Integration Guides – Extreme XOS
copyright © 2007 amigopod pty ltd.
Dated Tested: 13 June 2007
AmigoPod Version: EngineÆ0.99.35, Radius ServicesÆ0.6.10
Plugins Required: Standard build only
Extreme Hardware X450 (other XOS platforms should be supported)
Extreme S/W Version: EXOS 12.x
Integration: HTTP Captive Portal
Overview:
The Extreme range of Ethernet switches are based on a common operating system known as
ExtremeXOS. ExtremeXOS is a highly resilient, modular operating system that provides continuous
uptime, manageability and operational efficiency, including many advanced port security and NAC
features. The switch used for the integration testing was a Summit X450. The highly flexible Summit
X450e switch provides high-density gigabit plus optional 10 Gigabit Ethernet ports in a compact 1RU
format, supporting a wide range of Layer 2 to Layer 4 functionalities on every port.
Integration:
The key feature of the ExtremeXOS used to integrate with amigopod is its ability to support what
Extreme call their Network Login feature set. Network login controls the admission of user packets into a
network by allowing MAC addresses from users that are properly authenticated. Network login is
controlled on a per port basis. When network login is enabled on a port, that port does not forward any
packets until authentication takes place.
Network login is capable of three types of authentication: web-based, MAC-based, and 802.1x. In
addition, network login has two different modes of operation: Campus mode and ISP mode. The
authentication types and modes of operation can be used in any combination.
When web-based network login is enabled on a switch port, that port is placed into a non-forwarding
state until authentication takes place. To authenticate, a user must open a web browser and provide the
appropriate credentials. These credentials are either approved, in which case the port is placed in
forwarding mode, or not approved, in which case the port remains blocked. You can initiate user logout
by submitting a logout request or closing the logout window.
Currently EXOS only supports the use of the internally hosted authentication page although from version
12.x onwards the look and feel of this page can be heavily customized. Nonetheless, currently this
restriction prevents the use of the amigopod Web Logins feature that allows fully customizable external
authentication pages.

amigopod Integration Guides – Extreme XOS
copyright © 2007 amigopod pty ltd.
Step 1:
Starting with the X450 in a default configuration state, create three VLANs to represent the following
roles in the network design:
1. VLAN to connect corporate IT resources including the amigopod server (in example Office)
2. VLAN to connect to the Internet or DMZ segment (in example Guest)
3. VLAN to temporarily place the unauthenticated visitors piror to VLAN move (in example
unsecured)
create vlan "guest"
configure vlan guest tag 30
create vlan "office"
configure vlan office tag 10
create vlan "unsecured"
configure vlan unsecured tag 20
Step 2:
Now assign switch ports to the Office and Guest VLANs so the amigopod server and Internet/DMZ
connection can be made:
configure vlan Default delete ports all
configure vlan guest add ports 17-24 untagged
configure vlan office add ports 1-8 untagged
Note: There is no requirement at this point to assign switch ports to the unsecured VLAN as this is done
explicitly during the configuration of the Web Login feature in subsequent steps.
Step 3:
Assign IP Addressing details to each VLAN and ensure that IP Forwarding is enabled for only VLANs
office and guest (not unsecured):
configure vlan office ipaddress 10.0.20.1 255.255.255.0
enable ipforwarding vlan office
configure vlan unsecured ipaddress 192.168.2.1 255.255.255.0
configure vlan guest ipaddress 192.168.1.10 255.255.255.0
enable ipforwarding vlan guest

amigopod Integration Guides – Extreme XOS
copyright © 2007 amigopod pty ltd.
Step 4:
Next the unsecured VLAN must be enabled to support Web Login using the following commands:
configure netlogin vlan unsecured
enable netlogin web-based
enable netlogin ports 9-16 web-based
The following commands are defaults for the Web Login feature set – see the EXOS Concepts Guide for
more information on how these parameters can be modified to suit your implementation.
enable netlogin logout-privilege
enable netlogin session-refresh 3
configure netlogin base-url "network-access.com"
configure netlogin redirect-page "http://www.extremenetworks.com"
configure netlogin banner ""
Step 5:
Configure DHCP Service for the unsecured VLAN to allow visitor laptops to automatically receive a
temporary IP Address before being moved to the guest VLAN. The assumption of this example is that
DHCP is being served on the guest VLAN by the Internet gateway or other DHCP server.
configure vlan unsecured dhcp-address-range 192.168.2.50 - 192.168.2.99
configure vlan unsecured dhcp-options default-gateway 192.168.2.1
configure vlan unsecured dhcp-options dns-server 202.12.144.10
enable dhcp ports 9-16 vlan unsecured
Step 6:
Finally, the AAA RADIUS configuration of the Extreme X450 must be configured to point at the amigopod
server. In the example below the amigopod server is residing on IP Address 10.0.20.51 and the default
authentication and accounting ports are 1812 and 1813 respectively. The following XOS commands
configure the required AAA components to support Web Login functionality.
configure radius netlogin primary server 10.0.20.51 1812 client-ip 10.0.20.1 vr VR-
Default
configure radius netlogin primary shared-secret encrypted ue{ofdqw
configure radius-accounting netlogin primary server 10.0.20.51 1813 client-ip
10.0.20.1 vr VR-Default
configure radius-accounting netlogin primary shared-secret encrypted ue{ofdqw
Note: NAS Shared Secret _______________________ This will be required at a later step.

amigopod Integration Guides – Extreme XOS
copyright © 2007 amigopod pty ltd.
Step 7:
Now that a fixed IP Address has been defined for the Extreme X450 switch, this needs to be defined
within the amigopod configuration. Typically, the amigopod software is installed on an appliance or
server with a fixed IP Address and potentially a locally defined host name. Referring back to your initial
installation of the amigopod solution, open a web browser and enter either the IP Address or host name
defined during the installation. You should be presented with a login screen similar to the one below:
Enter your username and password. The default amigopod username is admin and the password is
amigopod.

amigopod Integration Guides – Extreme XOS
copyright © 2007 amigopod pty ltd.
Step 8
Once successfully logged into the AmigoPod administration interface, you will be presented with the
AmigoPod Home Page where the RADIUS Services section can be accessed. Click on RADIUS
Services on the screen shown below:

amigopod Integration Guides – Extreme XOS
copyright © 2007 amigopod pty ltd.
Step 9
From the Radius Services menu, select Network Access Servers:

amigopod Integration Guides – Extreme XOS
copyright © 2007 amigopod pty ltd.
Step 10
Being a new install, there are currently no NAS entries defined. Click on the Create icon at the top of the
page shown below:

amigopod Integration Guides – Extreme XOS
copyright © 2007 amigopod pty ltd.
Step 11
Fill out the details of the Create NAS form based on the IP Addressing details defined for the Extreme
Switch on the office VLAN in Step 3. Leave the default Other NAS entry for the NAS Type and define a
shared secret that was configured in the EXOS AAA configuration in Step 6. Once complete click on the
Create NAS Device button.

amigopod Integration Guides – Extreme XOS
copyright © 2007 amigopod pty ltd.
Step 12
Once the NAS has been created, the RADIUS Server needs to be restarted for the changes to take
affect. This can be seen from the warning message shown at the top of the screen and the button below
should be clicked to initiate a restart of the RADIUS services.
Once the RADIUS services have restarted the next step is to create the RADIUS Vendor Specific
Attributes (VSA) required to implement the VLAN Move on positive authentication. These are defined
through the amigopod RADIUS Services ÆUser Roles and Dictionary Menu Options. Click on User
Roles from the RADIUS Services Menu.

amigopod Integration Guides – Extreme XOS
copyright © 2007 amigopod pty ltd.
Step 13
Being a new install, there are currently no Extreme Specific User Roles defined. A User Role is a
collection or RADIUS standard or Vendor Specific attributes that defined the way a RADIUS NAS should
respond to a positive authentication. In the case of Extreme XOS, the following VSA are defined and
available for use in this style of configuration. For more information on these attributes please refer to the
Extreme XOS Concepts Guide: