Avaya ERS 5600 Manuel utilisateur

> Device Authentication using Identity

Engines Ignition Server Technical

Configuration Guide

Enterprise Solutions Engineering

Document Date: April 2010

Document Number: NN48500-586

Document Version: 2.0

Identify Engines Ignition Server

Ethernet Routing Switch

5500 5600 4500 2500

Engineering

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

Abstract

This Technical Configuration Guide outlines the configuration steps required to create an

authenticated network infrastructure for biomedical devices that are Ethernet attached. The main

components include both the Ethernet edge switches and the Network Access Control

infrastructure provided by Avaya’s Identity Engines portfolio.

The audience for this Technical Configuration Guide is intended to be Avaya Sales teams,

Partner Sales teams and end-user customers.

Revision Control

Date

Version

Revised by

Remarks

09/09/2009

1.0

JVE

Modifications to Software Baseline section

27/04/2010

2.0

JVE

Added Internal Device configuration

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

Table of Contents

Conventions................................................................................................................................... 3

1. Overview: Medical Device Authentication using Identify Engines................................... 4

1.1 Access Layer ................................................................................................................... 4

1.2 Ignition Server –Biomedical Device Authentication........................................................ 4

1.3 Configuration Examples .................................................................................................. 5

1.4 Biomedical Device Authentication using Identify Engines Ignition Server and ERS55005

2. Software Baseline................................................................................................................ 50

3. Reference Documentation.................................................................................................. 51

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

Conventions

This section describes the text, image, and command conventions used in this document.

Symbols:



Tip –Highlights a configuration or technical tip.



Note –Highlights important information to the reader.



Warning –Highlights important information about an action that may result in equipment

damage, configuration or data loss.

Text:

Bold text indicates emphasis.

Italic text in a Courier New font indicates text the user must enter or select in a menu item, button

or command:

ERS5520-48T# show running-config

Output examples from Avaya devices are displayed in a Lucinda Console font:

ERS5520-48T# show running-config

! Embedded ASCII Configuration Generator Script

! Model = Ethernet Routing Switch 5520-24T-PWR

! Software version = v5.0.0.011

enable

configure terminal

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

1. Overview: Medical Device Authentication

using Identify Engines

This document provides the framework for implementing device level authentication controls.

Future documents will build on this as a base to further define pre-canned solutions that utilize

device level authentication.

1.1 Access Layer

Any of the following access layer switches that can be used with Ignition Server for device

authentication. However, only the ERS5500 or ERS5600 series can be used if User Access

Policies are also required allowing the RADIUS server to tell the switch what policy to apply for a

specific user or device.

ERS5500

ERS5600

ERS4500

ERS2400

1.2 Ignition Server –Biomedical Device Authentication

For the Ignition Server to authenticate biomedical devices from an EAP authenticator, it must

know the device identity (typically the MAC address). In an existing network consisting of many

biomedical devices, most likely each device identity will not be known, thus making it very difficult

to authorize each device based solely on the full MAC address. Avaya’s Ignition Server can be

configured for device authentication using just the prefix of the biomedical manufacturer’s vendor

MAC. In turn, the Ignition Server can keep a data base of the full MAC address of each device

once it is authenticated by the Ignition Server.

The following is a list of top biomedical manufacturers vendor MAC’s.

Prefix

Vendor

00095C

Philips Medical System –Cardiac and Monitoring System

00251B

Philips CareServant

001865

Siemens Medical Solutions Diagnostics Manufacturing

(formerly Bayer Diagnostics Sudbury Ltd)

0030E6

Draeger Medical Systems, Inc. (was: SIEMENS MEDICAL SYSTEMS)

0003B1

Hospira Inc. (was: Abbott Laboratories)

001AFA

Welch Allyn, Inc.

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

1.3 Configuration Examples

Although any Avaya switch as shown in Section 1.1 could be used, for this example, we will use

an ERS5520 for allow for both device authentication with or without policy.

1.4 Biomedical Device Authentication using Identify

Engines Ignition Server and ERS5500

For this example, we will demonstrate how to configure the Ethernet Routing Switch 5500 and

Ignition Server to allow for device authentication based on the biomedical manufacturer vendor

MAC address. This will allow authentication and VLAN separation of manufacturer traffic. All that

is required is the first three digits of the vendor MAC address for the Ignition Server to

authenticate the device and then tell the EAP authenticator (ERS 5520 in this example) what

VLAN to place the biomedical device in (we will use Philips and Siemens for this example).

The Ethernet Routing Switch 5500 can be configured to accept both EAP and non-EAP (NEAP)

on the same port. In regards to non-EAP, the switch can be configured to accept a password

format using any combination of IP address and MAC address with or without port number. By

default, the password format is set for IP address, MAC address, and port number. For this

example, Ignition Server will be configured for device authentication so it is not important how the

password format is configured on the ERS 5520. However, it is suggested to use a password

format of MAC address so that if the complete MAC address is known, we can use user

authentication versus device authentication on Ignition server.

Overall, we will configured the following

Enable NEAP on ports 14 to 20 of ERS5520 using the non-EAP password format of MAC

address only

Add VLAN 1500 for the Philips devices

Add VLAN 1600 for the Siemens devices

Add VLAN 3000 as the default VLAN everyone connects to until authenticated by Ignition

Server

Configure the Ethernet Routing Switch 5520 and Ignition server with shared key set to

nortel

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

Add the recommended settings for connectivity to an SMLT Cluster –VLACP and

Multilink Trunking (MLT) with Spanning Tree disabled on the uplink core ports 23 and 24

1.4.1 ERS Switch Configuration

1.4.1.1 Go to configuration mode.

ERS5520-1 Step 1 - Enter configuration mode

5520-24T-PWR> enable

5520-24T-PWR# configure terminal

5520-24T-PWR(config)# cmd-interface cli

5520-24T-PWR(config)# banner disable

5520-24T-PWR(config)# snmp-server name 5520-24T-1

1.4.1.2 Create VLAN‟s

ERS5520-1 Step 1 –Create VLAN‟s 201, 1500, 1600, and 3000

5520-24T-1(config)# vlan create 201 name mgmt type port

5520-24T-1(config)# vlan create 1500 name philips type port

5520-24T-1(config)# vlan create 1600 name siemens type port

5520-24T-1(config)# vlan create 3000 name general type port

ERS5520-1 Step 2 –Enable VLAN tagging on all appropriate ports

5520-24T-1(config)# vlan port 23-24 tagging tagall

ERS5520-1 Step 3 –Set VLAN configuration control to automatic, add VLAN port

members, and set the management VLAN to VLAN 201

5520-24T-1(config)# vlan configcontrol automatic

5520-24T-1(config)# vlan members add 201 23-24

5520-24T-1(config)# vlan members add 1500 23-24

5520-24T-1(config)# vlan members add 1600 23-24

5520-24T-1(config)# vlan members add 3000,14-20,23-24

5520-24T-1(config)# vlan mgmt 201

ERS5520-1 Step 4 –Remove port members from the default VLAN

5520-24T-1(config)# vlan members remove 1 14-20,23-24



Please note that the non-EAP devices must be a member of a VLAN for the switch to

authenticate the devices. You can either leave port member 14-20 in VLAN 1 or create

a separate VLAN and add the port members as we have done by creating VLAN 3000.

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

1.4.1.3 Create MLT

ERS5520-1: Step 1 –Create MLT 1

5520-1(config)# mlt 1 member 23-24 learning disable

5520-1(config)# mlt 1 enable

1.4.1.4 VLACP

ERS5520-1: Step 1 –Enable VLACP

5520-1(config)# vlacp macaddress 180.c200.f

5520-1(config)# vlacp enable

5520-1(config)# interface fastEthernet 23-24

5520-1(config-if)# vlacp timeout short

5520-1(config-if)# vlacp timeout-scale 5

5520-1(config-if)# vlacp enable

5520-1(config-if)# exit

1.4.1.5 Discard Untagged Frames on port uplink ports

ERS5520-1: Step 1 –Enable Discard Untagged Frames

5520-1(config)# vlan ports 23-24 filter-untagged-frame enable

1.4.1.6 Enable Spanning Tree Fast Start and BPDU Filtering on access ports

ERS5520-1 Step 1 –Enable STP Fast Start and BPDU filtering on access port 14-20

5520-24T-1(config)# interface fastEthernet 14-20

5520-24T-1(config-if)# spanning-tree learning fast

5520-24T-1(config-if)# spanning-tree bpdu-filtering timeout 0

5520-24T-1(config-if)# spanning-tree bpdu-filtering enable

5520-24T-1(config-if)# exit

1.4.1.7 Configure Management IP address on switch

ERS5520-1 Step 1 –Set the IP address of the switch

5520-24T-1(config)# interface vlan 201

5520-24T-1(config-if)# ip address 47.133.56.66 netmask 255.255.255.0

5520-24T-1(config-if)# exit

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

ERS5520-1 Step 1 –Add the default route

5520-24T-1(config)# ip routing

5520-24T-1(config)# ip route 0.0.0.0 0.0.0.0 47.133.56.1 1

1.4.1.8 Configure RADIUS server

ERS5520-1 Step 1 –Add RADIUS server using key „nortel‟

5520-24T-1(config)# radius-server host 47.133.56.101 key

Enter key: ******

Confirm key: ******



Please note that at this time, non-EAP MAC RADIUS accounting is not supported.

Hence this example does not include the step to enable RADIUS accounting. If you

wish, you can enable RADIUS accounting using the command radius accounting

enable.

1.4.1.9 Enable EAP globally

ERS5520-1 Step 1 –Enable non-EAP (NEAP)

5520-24T-1(config)# eap multihost allow-non-eap-enable

ERS5520-1 Step 2 –Enable RADIUS authentication for non-EAP (NEAP)

5520-24T-1(config)# eap multihost radius-non-eap-enable

ERS5520-1 Step 3 –Enable RADIUS non-EAP (NEAP) RADIUS assigned VLAN

5520-24T-1(config)# eapol multihost non-eap-use-radius-assigned-vlan

ERS5520-1 Step 2 –Remove the default NEAP password format of

IpAddr.MACAddr.PortNumber

5520-24T-1(config)# no eapol multihost non-eap-pwd-fmt

ERS5520-1 Step 3 –Enable NEAP password format of MAC address only

5520-24T-1(config)# eapol multihost non-eap-pwd-fmt mac-addr

ERS5520-1 Step 4 –Enable EAP globally

5520-24T-1(config)# eapol enable

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

1.4.1.10 Enable EAP at interface level

ERS5520-1 Step 1 –Enable EAP on port 14-20 with NEAP, set the maximum allowable EAP

and NEAP clients to 1, enable EAP multihost and enable RADIUS NEAP phone

5520-24T-1(config)# interface fastEthernet 14-20

5520-24T-1(config-if)# eapol status auto

5520-24T-1(config-if)# eapol multihost allow-non-eap-enable

5520-24T-1(config-if)# eapol multihost eap-mac-max 1

5520-24T-1(config-if)# eapol multihost non-eap-mac-max 1

5520-24T-1(config-if)# eapol multihost radius-non-eap-enable

5520-24T-1(config-if)# eapol multihost non-eap-use-radius-assigned-vlan

5520-24T-1(config-if)# eapol multihost enable

5520-24T-1(config-if)# exit

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Avaya Routeur réseau

Avaya

Avaya 3500 series Manuel utilisateur

Avaya

Avaya NN48500-598 Manuel utilisateur

Avaya

Avaya ERS 4500 Manuel utilisateur

Avaya

Avaya SR 2330 Manuel utilisateur

Avaya

Avaya 8800 Series Manuel utilisateur

Avaya

Avaya ERS 3510GT-PWR+ Manuel utilisateur

Avaya

Avaya X330WAN Manuel utilisateur

Avaya

Avaya P333T-PWR Manuel de l'opérateur

Avaya

Avaya 3500 series Manuel utilisateur

Avaya

Avaya ERS4826GTS Manuel

Avaya

Avaya VSP 4000 Series Manuel utilisateur

Avaya

Avaya AG 2330 Manuel utilisateur

Avaya

Avaya 3524gt Mode d'emploi

Avaya

Avaya 8600 Manuel utilisateur

Avaya

Avaya P112T Manuel utilisateur

Avaya

Avaya ERS 8800 Manuel utilisateur

Avaya

Avaya ERS 2500 Manuel utilisateur

Avaya

Avaya P117F(R) Manuel utilisateur

Avaya

Avaya 5600 Series Manuel utilisateur

Avaya

Avaya 8180 Manuel utilisateur

Avaya

Avaya ERS 1600 Manuel utilisateur

Avaya

Avaya ERS 5510 Manuel utilisateur

Avaya

Avaya ERS 4926GTS Manuel utilisateur

Avaya

Avaya Secure Router 4134 Manuel utilisateur

Manuels Routeur réseau populaires d'autres marques

Allnet

Allnet ALL0333AU Manuel utilisateur

HomeSeer

HomeSeer HT-SEL Manuel utilisateur

Sercomm

Sercomm Genesis OC3505D Manuel utilisateur

Billion

Billion BIPAC 5102 Series Manuel utilisateur

TP-Link

TP-Link TD-8817 Manuel utilisateur

Motorola

Motorola MR1900 Manuel utilisateur

Digi

Digi IX14 Manuel utilisateur

Cisco

Cisco NCS 540 Manuel

XAVi

XAVi X8821e Manuel utilisateur

BEC

BEC 6200WZL Manuel utilisateur

MikroTik

MikroTik hAP ac3 Series Manuel utilisateur

Korenix

Korenix JetNet 5428G Series Manuel utilisateur

NETGEAR

NETGEAR FS526T - Switch Manuel utilisateur

Korenix

Korenix JetNet 5710G Series Manuel utilisateur

Automated Logic

Automated Logic ZN551 Manuel du propriétaire

Cisco

Cisco ASR 1000 Series Manuel de l'opérateur

EnGenius

EnGenius ESR-9710 Manuel utilisateur

Cisco

Cisco 805 Series Instructions d'utilisation et de sécurité