// to display images directly on GitHub
ifdef::env-github[]
:encoding: UTF-8
:lang: en
:doctype: book
:toc: left
:imagesdir: ../../images
endif::[]

////

    This file is part of the PacketFence project.

    See PacketFence_Network_Devices_Configuration_Guide.asciidoc
    for authors, copyright and license information.

////


//=== AlliedTelesis

==== AT8000GS

PacketFence supports the AT8000GS switch using :

* MAC Authentication
* 802.1X
* 802.1X + VOIP

===== Assumptions

  PacketFence management IP: 192.168.1.5
  Switch management IP: 10.0.0.14
  Guest VLAN (Internet): VLAN 1

===== MAC Authentication

First, enable 802.1X globally:

   dot1x system-auth-control

Next, configure the RADIUS server and AAA settings:

   radius-server host 192.168.1.5               
   radius-server key useStrongerSecret
   radius-server source-ip 10.0.0.14
   aaa authentication dot1x default radius 
   aaa accounting dot1x radius

In order to get mac authentication, you need to enable the guest VLAN globally: 

   interface vlan 1
   name "Guest Vlan"
   dot1x guest-vlan
   exit

Finally, enable the necessary 802.1X settings for mac-only authentication:

   interface ethernet g1
   dot1x mac-authentication mac-only
   dot1x radius-attributes vlan                
   dot1x port-control auto
   dot1x guest-vlan enable


===== 802.1X

The settings are almost the same as the MAC Authentication with some small differences.

First, enable 802.1X globally:

   dot1x system-auth-control

Next, configure the RADIUS server and AAA settings:

   radius-server host 192.168.1.5               
   radius-server key useStrongerSecret
   radius-server source-ip 10.0.0.14
   aaa authentication dot1x default radius 
   aaa accounting dot1x radius

Finally, enable the necessary 802.1X settings:

   interface ethernet g1    
   dot1x radius-attributes vlan
   dot1x port-control auto

===== 802.1X + VOIP

First, enable 802.1X globally:

   dot1x system-auth-control

Next, configure the RADIUS server configuration and AAA settings:


   radius-server host 192.168.1.5               
   radius-server key useStrongerSecret
   radius-server source-ip 10.0.0.14
   aaa authentication dot1x default radius 
   aaa accounting dot1x radius

Then, LLDP configuration:

   hostname switch-name
   ip domain-name domain.local
   lldp med network-policy 1 voice vlan 100 vlan-type tagged dscp 34
   lldp med network-policy 2 voice-signaling vlan 100 vlan-type tagged dscp 34

Finally, enable the necessary 802.1X and VOIP settings on each interface:

   interface ethernet g1
    dot1x port-control force-authorized
    no dot1x guest-vlan enable
    no dot1x mac-authentication
    no dot1x radius-attributes vlan
    no dot1x re-authentication
    switchport mode trunk
    switchport trunk native vlan 5
    switchport trunk allowed vlan add 100
    lldp med enable network-policy
    lldp med network-policy add 1
    lldp med network-policy add 2


===== 802.1X commands

  show dot1x supplicant brief

==== GS950

PacketFence supports the GS950 switch using :

* MAC Authentication
* 802.1X (without fallback to MAC authentication)

===== Global configuration

First, ensure that the VLANs you want to assign are part of the VLAN database via the following page:

image::allied-telesis-gs950/vlan-config.png[scaledwidth="100%",alt="VLAN configuration"]

Note that they only need to be tagged on the trunk and don't need any specific configuration for the dynamic VLAN assignment here.

Next, configure the RADIUS server (_Security -> RADIUS_):

image::allied-telesis-gs950/radius-server.png[scaledwidth="100%",alt="RADIUS configuration"]

Next, configure an SNMP community (_SNMP -> Community Table_)

image::allied-telesis-gs950/snmp-config.png[scaledwidth="100%",alt="SNMP configuration"]

===== MAC authentication

Go in _Security -> Port Access Control_, select the port you want to enable MAB on, and ensure you set:

[options="compact"]
* Authentication Mode: MAC Based
* Port Control: Auto
* Supplicant Mode: Single
* VLAN Assignment: Enabled

image::allied-telesis-gs950/port-control-MAB.png[scaledwidth="100%",alt="MAB config"]

===== 802.1x

Go in _Security -> Port Access Control_, select the port you want to enable MAB on, and ensure you set:

[options="compact"]
* Authentication Mode: 802.1X
* Port Control: Auto
* Supplicant Mode: Multiple
* VLAN Assignment: Enabled

image::allied-telesis-gs950/port-control-802.1x.png[scaledwidth="100%",alt="802.1x configuration"]

===== PacketFence configuration

Ensure you configure at least:

[options="compact"]
* Type: Allied Telesis GS950
* RADIUS secret: useStrongerSecret
* SNMP Version: v2c
* SNMP Community Read: private
* SNMP Community Write: private

If you are using MAC authentication on this switch, you must adjust the FreeRADIUS configuration so it transforms the EAP requests this switch sends into requests that PacketFence will interpret as MAC authentication. This configuration will also set missing attributes in the RADIUS requests since this switch doesn't follow the standard attributes that are usually sent during RADIUS authentication.

To adjust it, go in `/usr/local/pf/conf/radiusd/packetfence` and add the following below the line that contains `packetfence-eap-mac-policy`:

  packetfence-allied-gs950-mab

And then restart FreeRADIUS:

  # /usr/local/pf/bin/pfcmd service radiusd restart

