VSI manipulation

As shown in Figure 45, when the device acts as both a VXLAN VTEP and a NAS, users' service information cannot be identified by VLANs. To resolve this issue, you must configure the RADIUS server to assign VSIs to MAC authenticated users. The NAS will map a user's traffic to the VXLAN that is associated with the user's authorization VSI. The mapping criteria include the user's access VLAN, access port, and MAC address.

For information about VSIs and VXLANs, see VXLAN Configuration Guide.

An authorization VSI is associated with a VXLAN that has network resources inaccessible to unauthenticated users.

MAC authentication supports remote VSI authorization. If the VTEP does not receive authorization VSI information for a MAC authentication user from the remote server, the user cannot access resources in any VXLAN after passing authentication. If the VTEP receives authorization VSI information for the user from the remote server, it performs the following operations:

• Dynamically creates an Ethernet service instance according to the user's access port, VLAN, and MAC address.

• Maps the Ethernet service instance to the authorization VSI.

  The user then can access resources in the VXLAN associated with the authorization VSI.

For information about dynamic creation of Ethernet service instances, see VXLAN configuration Guide.

The MAC authentication guest VSI on a port accommodates users that have failed MAC authentication for any reason other than server unreachable. For example, the VSI accommodates users with invalid passwords entered.

You can deploy a limited set of network resources in the VXLAN that is associated with the MAC authentication guest VSI. For example, a software server for downloading software and system patches.

Table 16 shows the way that the VTEP handles guest VSIs for MAC authentication users.

The MAC authentication critical VSI on a port accommodates users that have failed MAC authentication because no RADIUS authentication servers are reachable. Users in a MAC authentication critical VSI can access only network resources in the VXLAN associated with this VSI.

The critical VSI feature takes effect when MAC authentication is performed only through RADIUS servers. If a MAC authentication user fails local authentication after RADIUS authentication, the user is not assigned to the critical VSI. For more information about the authentication methods, see "Configuring AAA."

Table 17 shows the way that the VTEP handles critical VSIs for MAC authentication users.