Authenticating dynamic VLANs ranges using different profiles

You can set up the software to authenticate and authorize different sets of VLAN ranges on the same interface each using a different access profile. In earlier releases, all dynamic VLAN ranges on the same interface, are authenticated and authorized using the same access profile. With this feature, you can have different access profiles for different types of VLANs; for example, voice or data VLANs. If an S-VLAN being used for voice traffic goes down, and the NASREQ server is also down, you can set up the access profile for the S-VLAN so that it comes up without requiring authorization. At the same time, you can configure access profiles for data VLANs that require authorization before the VLAN comes back up.

 To configure this feature, assign a different access profile to each dynamic profile configured on a VLAN.

 For example: 

[edit interfaces ge-1/0/0] auto-configure { vlan-ranges { dynamic-profile svlan-profile-1 { accept any; ranges { 101-110; 111-120; 121-130; } access-profile svlan-access-profile-1; } dynamic-profile vlan-profile-2 { accept any; ranges { 201-210; 211-220; 221-230; } access-profile vlan-access-profile-2; } 

 Use the following command to configure an access profile that does not require authorization if the NASREQ is down: user@host# set access profile svlan-access-profile svlan_access_profile_name authorization-order nasreq none If you configure access profiles for dynamic VLANs in a dynamic profile, you must configure an access profile in each dynamic profile configured on the VLAN. If you configure multiple access profiles at different levels of the hierarchy, and a conflict occurs, the router applies the access profiles based on the following precedence rules: 

• If you assign multiple access profiles, the most specific access profile assignment takes precedence over any other access profile assignment. 
• If you assign an access profile at a new level, it takes precedence over any other access profile assignment.