CloudLabBox
Try the free demo

JNCIP-ENT lab 15 of 19

802-1X MAC RADIUS and fallback VLANs

Close a port with real 802.1X against a RADIUS server, assign a VLAN from RADIUS, admit a device with MAC RADIUS, and send each kind of failure to a restricted VLAN.

Run this lab

It needs Lite: its 3 nodes are set to 6 vCPU and 7,168 MB in total. That fits the free demo too.

In your workspace: Shared, then JNCIP-ENT JN0-650 guided labs, then 15 - 802-1X MAC RADIUS and fallback VLANs

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
6 vCPU, 7,168 MB
Smallest plan
Lite

The scenario

Anyone can walk into a Northmere depot and plug a laptop into a wall port. You'll change that with port-based access control. H1 is the RADIUS server, and it's running already. H2 is a PC on the port you'll protect. SW1 is the authenticator, H2 is the supplicant, and H1 is the authentication server. These are real 802.1X exchanges: EAPOL frames from H2 and RADIUS packets to H1.

DeviceInterfaceAddress
SW1ge-0/0/1To H1, access V10
SW1ge-0/0/2To H2, access V10
SW1irb.10, irb.3010.10.0.1/24, 10.30.0.1/24
H1eth010.10.0.10/24, RADIUS with secret lab123
H2eth010.10.0.20/24, and 10.30.0.20/24 for tests in V30

V30 is the restricted VLAN, for guests and anything else that fails.

ProgramHostWhat it does
radiusdH1A small RADIUS server. Users are in /root/users.txt, one a line: name password [vlan]. It reads the file on each request, and logs to /root/radius.log.
dot1x NAME PASSWORDH2A small 802.1X supplicant using EAP-MD5. Add --logoff to log off.

What you’ll practise

  • Explain the 802.1X process flow
  • Configure an access profile and the authenticator
  • Assign a VLAN from RADIUS
  • Configure MAC RADIUS
  • Configure guest, server-reject and server-fail fallbacks

The tasks

  1. Turn on 802.1X and watch the port close
  2. Authenticate, log off and fail
  3. Assign a VLAN from RADIUS
  4. Let a printer in with MAC RADIUS
  5. Send what fails to a restricted VLAN

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of 802-1X MAC RADIUS and fallback VLANs3 nodes, 2 links. Every link is listed as text below the diagram.SW1H1H2ge-0/0/1eth0ge-0/0/2eth0
3 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SW1 ge-0/0/1 to H1 eth0
  • SW1 ge-0/0/2 to H2 eth0
Nodes in 802-1X MAC RADIUS and fallback VLANs, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SW1Juniper vJunos-switchvjunosswitch-23.4R2-S2.14 vCPU, 5,120 MB
H1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
H2EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder JNCIP-ENT JN0-650 guided labs.

  3. Open 15 - 802-1X MAC RADIUS and fallback VLANs and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More JNCIP-ENT labs

All JNCIP-ENT labs

Related labs in other courses

CloudLabBox is independent of Cisco and Juniper Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.