Avaya ERS 5600 Manual de usuario

> Device Authentication using Identity

Engines Ignition Server Technical

Configuration Guide

Enterprise Solutions Engineering

Document Date: April 2010

Document Number: NN48500-586

Document Version: 2.0

Identify Engines Ignition Server

Ethernet Routing Switch

5500 5600 4500 2500

Engineering

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

Abstract

This Technical Configuration Guide outlines the configuration steps required to create an

authenticated network infrastructure for biomedical devices that are Ethernet attached. The main

components include both the Ethernet edge switches and the Network Access Control

infrastructure provided by Avaya’s Identity Engines portfolio.

The audience for this Technical Configuration Guide is intended to be Avaya Sales teams,

Partner Sales teams and end-user customers.

Revision Control

Date

Version

Revised by

Remarks

09/09/2009

1.0

JVE

Modifications to Software Baseline section

27/04/2010

2.0

JVE

Added Internal Device configuration

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

Table of Contents

Conventions................................................................................................................................... 3

1. Overview: Medical Device Authentication using Identify Engines................................... 4

1.1 Access Layer ................................................................................................................... 4

1.2 Ignition Server –Biomedical Device Authentication........................................................ 4

1.3 Configuration Examples .................................................................................................. 5

1.4 Biomedical Device Authentication using Identify Engines Ignition Server and ERS55005

2. Software Baseline................................................................................................................ 50

3. Reference Documentation.................................................................................................. 51

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

Conventions

This section describes the text, image, and command conventions used in this document.

Symbols:



Tip –Highlights a configuration or technical tip.



Note –Highlights important information to the reader.



Warning –Highlights important information about an action that may result in equipment

damage, configuration or data loss.

Text:

Bold text indicates emphasis.

Italic text in a Courier New font indicates text the user must enter or select in a menu item, button

or command:

ERS5520-48T# show running-config

Output examples from Avaya devices are displayed in a Lucinda Console font:

ERS5520-48T# show running-config

! Embedded ASCII Configuration Generator Script

! Model = Ethernet Routing Switch 5520-24T-PWR

! Software version = v5.0.0.011

enable

configure terminal

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

1. Overview: Medical Device Authentication

using Identify Engines

This document provides the framework for implementing device level authentication controls.

Future documents will build on this as a base to further define pre-canned solutions that utilize

device level authentication.

1.1 Access Layer

Any of the following access layer switches that can be used with Ignition Server for device

authentication. However, only the ERS5500 or ERS5600 series can be used if User Access

Policies are also required allowing the RADIUS server to tell the switch what policy to apply for a

specific user or device.

ERS5500

ERS5600

ERS4500

ERS2400

1.2 Ignition Server –Biomedical Device Authentication

For the Ignition Server to authenticate biomedical devices from an EAP authenticator, it must

know the device identity (typically the MAC address). In an existing network consisting of many

biomedical devices, most likely each device identity will not be known, thus making it very difficult

to authorize each device based solely on the full MAC address. Avaya’s Ignition Server can be

configured for device authentication using just the prefix of the biomedical manufacturer’s vendor

MAC. In turn, the Ignition Server can keep a data base of the full MAC address of each device

once it is authenticated by the Ignition Server.

The following is a list of top biomedical manufacturers vendor MAC’s.

Prefix

Vendor

00095C

Philips Medical System –Cardiac and Monitoring System

00251B

Philips CareServant

001865

Siemens Medical Solutions Diagnostics Manufacturing

(formerly Bayer Diagnostics Sudbury Ltd)

0030E6

Draeger Medical Systems, Inc. (was: SIEMENS MEDICAL SYSTEMS)

0003B1

Hospira Inc. (was: Abbott Laboratories)

001AFA

Welch Allyn, Inc.

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

1.3 Configuration Examples

Although any Avaya switch as shown in Section 1.1 could be used, for this example, we will use

an ERS5520 for allow for both device authentication with or without policy.

1.4 Biomedical Device Authentication using Identify

Engines Ignition Server and ERS5500

For this example, we will demonstrate how to configure the Ethernet Routing Switch 5500 and

Ignition Server to allow for device authentication based on the biomedical manufacturer vendor

MAC address. This will allow authentication and VLAN separation of manufacturer traffic. All that

is required is the first three digits of the vendor MAC address for the Ignition Server to

authenticate the device and then tell the EAP authenticator (ERS 5520 in this example) what

VLAN to place the biomedical device in (we will use Philips and Siemens for this example).

The Ethernet Routing Switch 5500 can be configured to accept both EAP and non-EAP (NEAP)

on the same port. In regards to non-EAP, the switch can be configured to accept a password

format using any combination of IP address and MAC address with or without port number. By

default, the password format is set for IP address, MAC address, and port number. For this

example, Ignition Server will be configured for device authentication so it is not important how the

password format is configured on the ERS 5520. However, it is suggested to use a password

format of MAC address so that if the complete MAC address is known, we can use user

authentication versus device authentication on Ignition server.

Overall, we will configured the following

Enable NEAP on ports 14 to 20 of ERS5520 using the non-EAP password format of MAC

address only

Add VLAN 1500 for the Philips devices

Add VLAN 1600 for the Siemens devices

Add VLAN 3000 as the default VLAN everyone connects to until authenticated by Ignition

Server

Configure the Ethernet Routing Switch 5520 and Ignition server with shared key set to

nortel

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

Add the recommended settings for connectivity to an SMLT Cluster –VLACP and

Multilink Trunking (MLT) with Spanning Tree disabled on the uplink core ports 23 and 24

1.4.1 ERS Switch Configuration

1.4.1.1 Go to configuration mode.

ERS5520-1 Step 1 - Enter configuration mode

5520-24T-PWR> enable

5520-24T-PWR# configure terminal

5520-24T-PWR(config)# cmd-interface cli

5520-24T-PWR(config)# banner disable

5520-24T-PWR(config)# snmp-server name 5520-24T-1

1.4.1.2 Create VLAN‟s

ERS5520-1 Step 1 –Create VLAN‟s 201, 1500, 1600, and 3000

5520-24T-1(config)# vlan create 201 name mgmt type port

5520-24T-1(config)# vlan create 1500 name philips type port

5520-24T-1(config)# vlan create 1600 name siemens type port

5520-24T-1(config)# vlan create 3000 name general type port

ERS5520-1 Step 2 –Enable VLAN tagging on all appropriate ports

5520-24T-1(config)# vlan port 23-24 tagging tagall

ERS5520-1 Step 3 –Set VLAN configuration control to automatic, add VLAN port

members, and set the management VLAN to VLAN 201

5520-24T-1(config)# vlan configcontrol automatic

5520-24T-1(config)# vlan members add 201 23-24

5520-24T-1(config)# vlan members add 1500 23-24

5520-24T-1(config)# vlan members add 1600 23-24

5520-24T-1(config)# vlan members add 3000,14-20,23-24

5520-24T-1(config)# vlan mgmt 201

ERS5520-1 Step 4 –Remove port members from the default VLAN

5520-24T-1(config)# vlan members remove 1 14-20,23-24



Please note that the non-EAP devices must be a member of a VLAN for the switch to

authenticate the devices. You can either leave port member 14-20 in VLAN 1 or create

a separate VLAN and add the port members as we have done by creating VLAN 3000.

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

1.4.1.3 Create MLT

ERS5520-1: Step 1 –Create MLT 1

5520-1(config)# mlt 1 member 23-24 learning disable

5520-1(config)# mlt 1 enable

1.4.1.4 VLACP

ERS5520-1: Step 1 –Enable VLACP

5520-1(config)# vlacp macaddress 180.c200.f

5520-1(config)# vlacp enable

5520-1(config)# interface fastEthernet 23-24

5520-1(config-if)# vlacp timeout short

5520-1(config-if)# vlacp timeout-scale 5

5520-1(config-if)# vlacp enable

5520-1(config-if)# exit

1.4.1.5 Discard Untagged Frames on port uplink ports

ERS5520-1: Step 1 –Enable Discard Untagged Frames

5520-1(config)# vlan ports 23-24 filter-untagged-frame enable

1.4.1.6 Enable Spanning Tree Fast Start and BPDU Filtering on access ports

ERS5520-1 Step 1 –Enable STP Fast Start and BPDU filtering on access port 14-20

5520-24T-1(config)# interface fastEthernet 14-20

5520-24T-1(config-if)# spanning-tree learning fast

5520-24T-1(config-if)# spanning-tree bpdu-filtering timeout 0

5520-24T-1(config-if)# spanning-tree bpdu-filtering enable

5520-24T-1(config-if)# exit

1.4.1.7 Configure Management IP address on switch

ERS5520-1 Step 1 –Set the IP address of the switch

5520-24T-1(config)# interface vlan 201

5520-24T-1(config-if)# ip address 47.133.56.66 netmask 255.255.255.0

5520-24T-1(config-if)# exit

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

ERS5520-1 Step 1 –Add the default route

5520-24T-1(config)# ip routing

5520-24T-1(config)# ip route 0.0.0.0 0.0.0.0 47.133.56.1 1

1.4.1.8 Configure RADIUS server

ERS5520-1 Step 1 –Add RADIUS server using key „nortel‟

5520-24T-1(config)# radius-server host 47.133.56.101 key

Enter key: ******

Confirm key: ******



Please note that at this time, non-EAP MAC RADIUS accounting is not supported.

Hence this example does not include the step to enable RADIUS accounting. If you

wish, you can enable RADIUS accounting using the command radius accounting

enable.

1.4.1.9 Enable EAP globally

ERS5520-1 Step 1 –Enable non-EAP (NEAP)

5520-24T-1(config)# eap multihost allow-non-eap-enable

ERS5520-1 Step 2 –Enable RADIUS authentication for non-EAP (NEAP)

5520-24T-1(config)# eap multihost radius-non-eap-enable

ERS5520-1 Step 3 –Enable RADIUS non-EAP (NEAP) RADIUS assigned VLAN

5520-24T-1(config)# eapol multihost non-eap-use-radius-assigned-vlan

ERS5520-1 Step 2 –Remove the default NEAP password format of

IpAddr.MACAddr.PortNumber

5520-24T-1(config)# no eapol multihost non-eap-pwd-fmt

ERS5520-1 Step 3 –Enable NEAP password format of MAC address only

5520-24T-1(config)# eapol multihost non-eap-pwd-fmt mac-addr

ERS5520-1 Step 4 –Enable EAP globally

5520-24T-1(config)# eapol enable

Avaya Inc. –Proprietary & Confidential.

Use pursuant to the terms of your signed agreement or Avaya policy.

avaya.com

1.4.1.10 Enable EAP at interface level

ERS5520-1 Step 1 –Enable EAP on port 14-20 with NEAP, set the maximum allowable EAP

and NEAP clients to 1, enable EAP multihost and enable RADIUS NEAP phone

5520-24T-1(config)# interface fastEthernet 14-20

5520-24T-1(config-if)# eapol status auto

5520-24T-1(config-if)# eapol multihost allow-non-eap-enable

5520-24T-1(config-if)# eapol multihost eap-mac-max 1

5520-24T-1(config-if)# eapol multihost non-eap-mac-max 1

5520-24T-1(config-if)# eapol multihost radius-non-eap-enable

5520-24T-1(config-if)# eapol multihost non-eap-use-radius-assigned-vlan

5520-24T-1(config-if)# eapol multihost enable

5520-24T-1(config-if)# exit

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Enrutador de red de Avaya

Avaya

Avaya Ethernet Routing Switch 8300 Series Manual técnico

Avaya

Avaya 8800 Series Manual de instalación y operación

Avaya

Avaya 4524GT Hoja de instrucciones

Avaya

Avaya ERS 4926GTS Manual de usuario

Avaya

Avaya Advanced Gateway 2330 Manual de usuario

Avaya

Avaya 100 Series Guía del usuario

Avaya

Avaya Advanced Gateway 2330 Manual de usuario

Avaya

Avaya 5600 Series Manual de usuario

Avaya

Avaya ERS 3500 Series Manual de usuario

Avaya

Avaya 8000 Series Manual de usuario

Avaya

Avaya 3500 series Manual de usuario

Avaya

Avaya 4500 Series Manual de usuario

Avaya

Avaya P112T Manual de usuario

Avaya

Avaya 5900 Series Manual de instrucciones

Avaya

Avaya ERS 8600 Manual de usuario

Avaya

Avaya P117F(R) Manual de usuario

Avaya

Avaya 4000 Series Manual de usuario

Avaya

Avaya 8300 Series Guía rápida

Avaya

Avaya ERS 1600 Manual de usuario

Avaya

Avaya 8600 Guía de inicio rápido

Avaya

Avaya ERS 4500 Manual de usuario

Avaya

Avaya ERS 5510 Manual de usuario

Avaya

Avaya NN48500-598 Manual de usuario

Avaya

Avaya 8800 Series Manual técnico

Manuales populares de Enrutador de red de otras marcas

Allnet

Allnet ALL0333AU Manual de usuario

HomeSeer

HomeSeer HT-SEL Manual de usuario

Sercomm

Sercomm Genesis OC3505D Manual de usuario

Billion

Billion BIPAC 5102 Series Manual de usuario

TP-Link

TP-Link TD-8817 Manual de usuario

Motorola

Motorola MR1900 Manual de usuario

Digi

Digi IX14 Manual de usuario

Cisco

Cisco NCS 540 Manual

XAVi

XAVi X8821e Manual de usuario

BEC

BEC 6200WZL Manual de usuario

MikroTik

MikroTik hAP ac3 Series Manual de usuario

Korenix

Korenix JetNet 5428G Series Manual de usuario

NETGEAR

NETGEAR FS526T - Switch Manual de usuario

Korenix

Korenix JetNet 5710G Series Manual de usuario

Automated Logic

Automated Logic ZN551 Manual del propietario

Cisco

Cisco ASR 1000 Series Manual del operador

EnGenius

EnGenius ESR-9710 Manual de usuario

Cisco

Cisco 805 Series Instrucciones de funcionamiento y seguridad