Avaya ERS 5600 User manual

> Device Authentication using Identity
Engines Ignition Server Technical
Configuration Guide
Enterprise Solutions Engineering
Document Date: April 2010
Document Number: NN48500-586
Document Version: 2.0
Identify Engines Ignition Server
Ethernet Routing Switch
5500 5600 4500 2500
Engineering

Avaya Inc. –Proprietary & Confidential.
Use pursuant to the terms of your signed agreement or Avaya policy.
1
avaya.com
Abstract
This Technical Configuration Guide outlines the configuration steps required to create an
authenticated network infrastructure for biomedical devices that are Ethernet attached. The main
components include both the Ethernet edge switches and the Network Access Control
infrastructure provided by Avaya’s Identity Engines portfolio.
The audience for this Technical Configuration Guide is intended to be Avaya Sales teams,
Partner Sales teams and end-user customers.
Revision Control
No
Date
Version
Revised by
Remarks
1
09/09/2009
1.0
JVE
Modifications to Software Baseline section
2
27/04/2010
2.0
JVE
Added Internal Device configuration

Avaya Inc. –Proprietary & Confidential.
Use pursuant to the terms of your signed agreement or Avaya policy.
2
avaya.com
Table of Contents
Conventions................................................................................................................................... 3
1. Overview: Medical Device Authentication using Identify Engines................................... 4
1.1 Access Layer ................................................................................................................... 4
1.2 Ignition Server –Biomedical Device Authentication........................................................ 4
1.3 Configuration Examples .................................................................................................. 5
1.4 Biomedical Device Authentication using Identify Engines Ignition Server and ERS55005
2. Software Baseline................................................................................................................ 50
3. Reference Documentation.................................................................................................. 51

Avaya Inc. –Proprietary & Confidential.
Use pursuant to the terms of your signed agreement or Avaya policy.
3
avaya.com
Conventions
This section describes the text, image, and command conventions used in this document.
Symbols:

Tip –Highlights a configuration or technical tip.

Note –Highlights important information to the reader.

Warning –Highlights important information about an action that may result in equipment
damage, configuration or data loss.
Text:
Bold text indicates emphasis.
Italic text in a Courier New font indicates text the user must enter or select in a menu item, button
or command:
ERS5520-48T# show running-config
Output examples from Avaya devices are displayed in a Lucinda Console font:
ERS5520-48T# show running-config
! Embedded ASCII Configuration Generator Script
! Model = Ethernet Routing Switch 5520-24T-PWR
! Software version = v5.0.0.011
enable
configure terminal

Avaya Inc. –Proprietary & Confidential.
Use pursuant to the terms of your signed agreement or Avaya policy.
4
avaya.com
1. Overview: Medical Device Authentication
using Identify Engines
This document provides the framework for implementing device level authentication controls.
Future documents will build on this as a base to further define pre-canned solutions that utilize
device level authentication.
1.1 Access Layer
Any of the following access layer switches that can be used with Ignition Server for device
authentication. However, only the ERS5500 or ERS5600 series can be used if User Access
Policies are also required allowing the RADIUS server to tell the switch what policy to apply for a
specific user or device.
ERS5500
ERS5600
ERS4500
ERS2400
1.2 Ignition Server –Biomedical Device Authentication
For the Ignition Server to authenticate biomedical devices from an EAP authenticator, it must
know the device identity (typically the MAC address). In an existing network consisting of many
biomedical devices, most likely each device identity will not be known, thus making it very difficult
to authorize each device based solely on the full MAC address. Avaya’s Ignition Server can be
configured for device authentication using just the prefix of the biomedical manufacturer’s vendor
MAC. In turn, the Ignition Server can keep a data base of the full MAC address of each device
once it is authenticated by the Ignition Server.
The following is a list of top biomedical manufacturers vendor MAC’s.
Prefix
Vendor
00095C
Philips Medical System –Cardiac and Monitoring System
00251B
Philips CareServant
001865
Siemens Medical Solutions Diagnostics Manufacturing
(formerly Bayer Diagnostics Sudbury Ltd)
0030E6
Draeger Medical Systems, Inc. (was: SIEMENS MEDICAL SYSTEMS)
0003B1
Hospira Inc. (was: Abbott Laboratories)
001AFA
Welch Allyn, Inc.

Avaya Inc. –Proprietary & Confidential.
Use pursuant to the terms of your signed agreement or Avaya policy.
5
avaya.com
1.3 Configuration Examples
Although any Avaya switch as shown in Section 1.1 could be used, for this example, we will use
an ERS5520 for allow for both device authentication with or without policy.
1.4 Biomedical Device Authentication using Identify
Engines Ignition Server and ERS5500
For this example, we will demonstrate how to configure the Ethernet Routing Switch 5500 and
Ignition Server to allow for device authentication based on the biomedical manufacturer vendor
MAC address. This will allow authentication and VLAN separation of manufacturer traffic. All that
is required is the first three digits of the vendor MAC address for the Ignition Server to
authenticate the device and then tell the EAP authenticator (ERS 5520 in this example) what
VLAN to place the biomedical device in (we will use Philips and Siemens for this example).
The Ethernet Routing Switch 5500 can be configured to accept both EAP and non-EAP (NEAP)
on the same port. In regards to non-EAP, the switch can be configured to accept a password
format using any combination of IP address and MAC address with or without port number. By
default, the password format is set for IP address, MAC address, and port number. For this
example, Ignition Server will be configured for device authentication so it is not important how the
password format is configured on the ERS 5520. However, it is suggested to use a password
format of MAC address so that if the complete MAC address is known, we can use user
authentication versus device authentication on Ignition server.
Overall, we will configured the following
Enable NEAP on ports 14 to 20 of ERS5520 using the non-EAP password format of MAC
address only
Add VLAN 1500 for the Philips devices
Add VLAN 1600 for the Siemens devices
Add VLAN 3000 as the default VLAN everyone connects to until authenticated by Ignition
Server
Configure the Ethernet Routing Switch 5520 and Ignition server with shared key set to
nortel

Avaya Inc. –Proprietary & Confidential.
Use pursuant to the terms of your signed agreement or Avaya policy.
6
avaya.com
Add the recommended settings for connectivity to an SMLT Cluster –VLACP and
Multilink Trunking (MLT) with Spanning Tree disabled on the uplink core ports 23 and 24
1.4.1 ERS Switch Configuration
1.4.1.1 Go to configuration mode.
ERS5520-1 Step 1 - Enter configuration mode
5520-24T-PWR> enable
5520-24T-PWR# configure terminal
5520-24T-PWR(config)# cmd-interface cli
5520-24T-PWR(config)# banner disable
5520-24T-PWR(config)# snmp-server name 5520-24T-1
1.4.1.2 Create VLAN‟s
ERS5520-1 Step 1 –Create VLAN‟s 201, 1500, 1600, and 3000
5520-24T-1(config)# vlan create 201 name mgmt type port
5520-24T-1(config)# vlan create 1500 name philips type port
5520-24T-1(config)# vlan create 1600 name siemens type port
5520-24T-1(config)# vlan create 3000 name general type port
ERS5520-1 Step 2 –Enable VLAN tagging on all appropriate ports
5520-24T-1(config)# vlan port 23-24 tagging tagall
ERS5520-1 Step 3 –Set VLAN configuration control to automatic, add VLAN port
members, and set the management VLAN to VLAN 201
5520-24T-1(config)# vlan configcontrol automatic
5520-24T-1(config)# vlan members add 201 23-24
5520-24T-1(config)# vlan members add 1500 23-24
5520-24T-1(config)# vlan members add 1600 23-24
5520-24T-1(config)# vlan members add 3000,14-20,23-24
5520-24T-1(config)# vlan mgmt 201
ERS5520-1 Step 4 –Remove port members from the default VLAN
5520-24T-1(config)# vlan members remove 1 14-20,23-24

Please note that the non-EAP devices must be a member of a VLAN for the switch to
authenticate the devices. You can either leave port member 14-20 in VLAN 1 or create
a separate VLAN and add the port members as we have done by creating VLAN 3000.

Avaya Inc. –Proprietary & Confidential.
Use pursuant to the terms of your signed agreement or Avaya policy.
7
avaya.com
1.4.1.3 Create MLT
ERS5520-1: Step 1 –Create MLT 1
5520-1(config)# mlt 1 member 23-24 learning disable
5520-1(config)# mlt 1 enable
1.4.1.4 VLACP
ERS5520-1: Step 1 –Enable VLACP
5520-1(config)# vlacp macaddress 180.c200.f
5520-1(config)# vlacp enable
5520-1(config)# interface fastEthernet 23-24
5520-1(config-if)# vlacp timeout short
5520-1(config-if)# vlacp timeout-scale 5
5520-1(config-if)# vlacp enable
5520-1(config-if)# exit
1.4.1.5 Discard Untagged Frames on port uplink ports
ERS5520-1: Step 1 –Enable Discard Untagged Frames
5520-1(config)# vlan ports 23-24 filter-untagged-frame enable
1.4.1.6 Enable Spanning Tree Fast Start and BPDU Filtering on access ports
ERS5520-1 Step 1 –Enable STP Fast Start and BPDU filtering on access port 14-20
5520-24T-1(config)# interface fastEthernet 14-20
5520-24T-1(config-if)# spanning-tree learning fast
5520-24T-1(config-if)# spanning-tree bpdu-filtering timeout 0
5520-24T-1(config-if)# spanning-tree bpdu-filtering enable
5520-24T-1(config-if)# exit
1.4.1.7 Configure Management IP address on switch
ERS5520-1 Step 1 –Set the IP address of the switch
5520-24T-1(config)# interface vlan 201
5520-24T-1(config-if)# ip address 47.133.56.66 netmask 255.255.255.0
5520-24T-1(config-if)# exit

Avaya Inc. –Proprietary & Confidential.
Use pursuant to the terms of your signed agreement or Avaya policy.
8
avaya.com
ERS5520-1 Step 1 –Add the default route
5520-24T-1(config)# ip routing
5520-24T-1(config)# ip route 0.0.0.0 0.0.0.0 47.133.56.1 1
1.4.1.8 Configure RADIUS server
ERS5520-1 Step 1 –Add RADIUS server using key „nortel‟
5520-24T-1(config)# radius-server host 47.133.56.101 key
Enter key: ******
Confirm key: ******

Please note that at this time, non-EAP MAC RADIUS accounting is not supported.
Hence this example does not include the step to enable RADIUS accounting. If you
wish, you can enable RADIUS accounting using the command radius accounting
enable.
1.4.1.9 Enable EAP globally
ERS5520-1 Step 1 –Enable non-EAP (NEAP)
5520-24T-1(config)# eap multihost allow-non-eap-enable
ERS5520-1 Step 2 –Enable RADIUS authentication for non-EAP (NEAP)
5520-24T-1(config)# eap multihost radius-non-eap-enable
ERS5520-1 Step 3 –Enable RADIUS non-EAP (NEAP) RADIUS assigned VLAN
5520-24T-1(config)# eapol multihost non-eap-use-radius-assigned-vlan
ERS5520-1 Step 2 –Remove the default NEAP password format of
IpAddr.MACAddr.PortNumber
5520-24T-1(config)# no eapol multihost non-eap-pwd-fmt
ERS5520-1 Step 3 –Enable NEAP password format of MAC address only
5520-24T-1(config)# eapol multihost non-eap-pwd-fmt mac-addr
ERS5520-1 Step 4 –Enable EAP globally
5520-24T-1(config)# eapol enable

Avaya Inc. –Proprietary & Confidential.
Use pursuant to the terms of your signed agreement or Avaya policy.
9
avaya.com
1.4.1.10 Enable EAP at interface level
ERS5520-1 Step 1 –Enable EAP on port 14-20 with NEAP, set the maximum allowable EAP
and NEAP clients to 1, enable EAP multihost and enable RADIUS NEAP phone
5520-24T-1(config)# interface fastEthernet 14-20
5520-24T-1(config-if)# eapol status auto
5520-24T-1(config-if)# eapol multihost allow-non-eap-enable
5520-24T-1(config-if)# eapol multihost eap-mac-max 1
5520-24T-1(config-if)# eapol multihost non-eap-mac-max 1
5520-24T-1(config-if)# eapol multihost radius-non-eap-enable
5520-24T-1(config-if)# eapol multihost non-eap-use-radius-assigned-vlan
5520-24T-1(config-if)# eapol multihost enable
5520-24T-1(config-if)# exit