I85PREP
⌘ K
Extreme Certified Professional - Extreme Switching study materials
Extreme Certified Professional - Extreme Switching study resources

Extreme Certified Professional - Extreme Switching: Network Security, Authentication, and Access Control

Extreme Certified Professional - Extreme Switching · Work through your exam, one topic at a time.

All guide sections

Network Security, Authentication, and Access Control

Domain 6 - Network Security, Authentication, and Access Control. This domain tests local and remote authentication (RADIUS, TACACS+), network login on edge ports, and the ways you restrict who reaches the switch and what traffic crosses it.

Local and remote authentication

  • create account user jdoe creates a non-admin account; configure account jdoe sets its password and policy. show accounts lists users and access levels.
  • RADIUS: configure radius primary server 10.1.1.10 1812 client-ip 10.1.1.1 shared-secret "s3cr3t", optionally configure radius primary retries 3, then enable radius.
  • TACACS+ follows the same shape with configure tacacs primary server ... and enable tacacs.
  • Secrets and hashes appear in configuration output; protect exported configurations accordingly.

Edge authentication (network login)

  • enable netlogin, configure netlogin vlan <vlan>, then enable the methods you need: enable netlogin web-based, enable netlogin mac, enable netlogin dot1x.
  • Before authentication the port sits in the netlogin VLAN reaching only DHCP/DNS and the authentication server; after success the client is moved to its assigned VLAN.
  • MAC-based netlogin suits printers and cameras with no supplicant; 802.1X suits managed endpoints with a supplicant.

Traffic control

  • ACLs on ExtremeXOS are policy-based: match source/destination, protocol and port, then apply to ports or VLANs. Verify with show policy and confirm hit counters.
  • DHCP snooping and related IP-security features block rogue DHCP servers and spoofed addresses on untrusted edge ports; trust only the uplink facing the legitimate server.

Worked example

A lobby port must pass no traffic until the user authenticates. Create the quarantine VLAN, place the port untagged in it, configure netlogin vlan quarantine, enable netlogin, enable netlogin web-based, and point RADIUS at the corporate server. Reasoning: the netlogin VLAN must exist first, otherwise the client cannot obtain an address to reach the login portal. On an accept, the RADIUS attributes place the session in its assigned VLAN; show netlogin shows session state and VLAN. A rejected login leaves the client in the quarantine VLAN.

Traps

  • RADIUS shared-secret or client-IP mismatch - the server drops requests and logins quietly fall back to local accounts.
  • Enabling netlogin without a reachable netlogin VLAN, so no client can ever authenticate.
  • Leaving Telnet enabled and HTTP unencrypted while claiming management is secured.
  • Writing an ACL that matches the wrong direction or is applied to the wrong interface, then assuming it is enforced.