User Guide: AMF Security version 2.5.0 for VST-APL

# Quick Tour/Authentication using Tag

What is authentication using Tag
About the judgment order of Tag
Configuration example using Tag
Flow of setting using Tag
Registering Network
Registering Tag
Registering Device

This section describes how to configure authentication using Tag set to Device ID (Device) registered with AMF Security.

## What is authentication using Tag

Authentication by AMF Security can be performed by policies set to Tag in addition to security policies set to devices and UnAuth Group.
Normally, a terminal (MAC Address) is registered to the AMF Security device as follows and a policy is associated with it.

Table 1: Device ID (Device) registration example
Device ID (first)
Device ID | User 1
Interface (MAC Address) | 00:00:00:00:00:01 00:00:00:00:00:02
Policies | VLAN100
Device ID (second)
Device ID | User 2
Interface (MAC Address) | 00:00:00:00:00:03 00:00:00:00:00:04 00:00:00:00:00:05
Policies | VLAN100

In the above example, "User 1" has two terminals and "User 2" has three terminals, and each terminal is connected to VLAN100.
When managing the network to be connected by registering the terminal owned by the user as described above, when changing the network to be connected, it is necessary to change the setting (policy) of each user.
In such cases, authentication using tags can be used to change them all at once.

Table 2: Device ID (Device) registration example
Device ID (first)
Device ID | User 1
Interface (MAC Address) | 00:00:00:00:00:01 00:00:00:00:00:02
Policies | None
Device ID (second)
Device ID | User 2
Interface (MAC Address) | 00:00:00:00:00:03 00:00:00:00:00:04 00:00:00:00:00:05
Policies | None

Table 3: Tag registration example
Tag
Tag | Group A
Policies | VLAN100

In the above, instead of setting the policy to the device, the tag is set to the device and the policy is set to the separately created tag.
In this case, the basic operation is the same, but by changing the policy of a separately created tag, you can change the networks that users connect to at once.
Locations and schedules can be set for policies set to tags. For example, if the network to be connected changes depending on the location, this can be achieved by setting the location of the policy.

> Note

> > TQ's AMF Application Proxy does not support location and schedule items.

## About the judgment order of Tag

Policies assigned to tags are judged in ascending order of priority.
If multiple tags are registered, judgment is made in the order of priority of the policy assigned to each tag. Therefore, set different priorities for each policy.
Note that tags without a policy are not subject to judgment. Regardless of only one tag registration or multiple tag registrations. Also, set a priority-only policy if you don't need networks, locations, or schedules.

## Configuration example using Tag

Here, the description in Quick Tour/Authentication using tag > What is authentication using tag is set as an example.
The information of the terminal to be registered with AMF Security is assumed to be as follows.

- User 1 (user_1) owns two terminals (PC-1, PC-2)
- User 2 (user_2) owns 3 terminals (PC-3, PC-4, PC-5)
- Each terminal is connected to VLAN100

An overview of the authentication data (networks, devices, tags) to be registered with AMF Security is as follows.

- The network to which the terminal connects is VLAN100
- Device registers user 1 (user_1) and user 2 (user_2)
- Set common tags for devices
- Do not set policies on devices
- Set a policy for the tag (set network VLAN 100 to which the terminal connects)

With these settings, the network to which the 5 terminals registered in the devices "user_1" and "user_2" are connected is changed collectively only by changing the tag policy.
For example, if you want to change the network that connects five terminals from VLAN100 to VLAN101, you can simply change the network to VLAN101 in the tag policy.

Table 4: Device ID (Device) configuration data
Device ID (first)
Device ID | user_1
Tag | group_A
Interfaces
MAC Address | 00:00:00:00:00:01
Name | PC-1
Interfaces
MAC Address | 00:00:00:00:00:02
Name | PC-2
Policies | None
Device ID (second)
Device ID | user_2
Tag | group_A
Interfaces
MAC Address | 00:00:00:00:00:03
Name | PC-3
Interfaces
MAC Address | 00:00:00:00:00:04
Name | PC-4
Interfaces
MAC Address | 00:00:00:00:00:05
Name | PC-5
Policies | None

Table 5: Tag configuration data
Tag
Tag | group_A
Policies | VLAN100

### Flow of setting using Tag

The setting flow is shown below.

1. Register networks on the Policy Settings > Network List page
2. Register tags on the Group > Tag List page
3. Register devices on the Device > Add Device page

### Registering Network

Register the network to connect to. Networks can be registered on the Policy Settings > Network List page.

1. Open the Policy Settings > Network List page.

2. Click the "Add Tag" button at the top right corner to move to the Group > Add Tag page.

3. Enter information for the network to add.

   Configure the settings shown in the following table:

   Table 6: Sample Configuration Data
   Item Name | Value
   --- | ---
   Network ID | VLAN100
   VLAN ID | 100
   Note | (empty)

4. Click the "Submit" button.
   Once the network is registered, the added information is displayed on the Policy Settings > Network List page.

### Registering Tag

Register tags based on the set policy. Tags can be registered on the Group > Tag List page.

1. Open the Group > Tag List page.

2. Click the "Add Tag" button at the top right corner to move to the Group > Add Tag page.

3. Enter information for the tag to add.

   Configure the settings shown in the following table:

   Table 7: Configurable fields
   Item Name | Value
   --- | ---
   Tag | group_A
   Note | (empty)

4. Click the "Add" button next to "Policies" to open the Group > Edit Policy dialog.

5. Enter information for the policy.

   Configure the settings shown in the following table:

   Table 8: Configurable fields
   Item Name | Value
   --- | ---
   Priority | 10
   Network | VLAN100
   Location | (empty)
   Schedule | (empty)

6. Click the "Submit" button to return to the Group > Add Tag page.

7. Click the "Submit" button.
   Once the tag is registered, the added information is displayed on the Group > Tag List page.

### Registering Device

Register the Device ID (Device) in AMF Security. Devices can be registered on the Device > Add Device page.

1. Open the Device > Device List page.

2. Click the "Add Device" button at the top right corner of the Device > Device List page to move to the Device > Add Device page.
   On this page, register the device ID and tag of the new device.

3. Enter information about the new device.

   Configure the settings shown in the following table:

   Table 9: Configurable fields
   Item Name | Value
   --- | ---
   Device ID | user_1
   Tag | group_A
   Note | (empty)

4. Next, you have to enter the interface MAC Address of the device. AMF Security denies all network connections from unregistered MAC Addresses.
   Click the "Add" button next to "Interfaces" to open the Device > Edit Interface dialog.

5. Register the MAC Address and name of the first terminal of "User 1 (user_1)".

   Configure the settings shown in the following table:

   Table 10: Configurable fields
   Item Name | Value
   --- | ---
   MAC Address | 00:00:00:00:00:01
   Name | PC-1
   Note | (empty)

6. Click the "Submit" button.
   "Interfaces" section of the Device > Add Device page now shows the interface MAC Address which you just entered.

7. Register the MAC Address and name of the other terminal using the same procedure as steps 4 to 6.

   Configure the settings shown in the following table:

   Table 11: Configurable fields
   Item Name | Value
   --- | ---
   MAC Address | 00:00:00:00:00:02
   Name | PC-2
   Note | (empty)

8. Since no policy is set for this device "user_1", just click the "Submit" button.

   Once the device is registered, the newly added information is displayed on the Device > Device List page.

9. Register the "Device ID" of "user_2" using the same procedure as steps 2 to 8.
   For the tag to be registered in the "Device ID" of "user_2", register "group_A", which is common with "user_1".

   Table 12: Configurable fields
   Device
   Item Name | Value
   --- | ---
   Device ID | user_2
   Tag | group_A * Same as "user_1"
   Note | (empty)
   Interfaces
   Item Name | Value
   MAC Address | 00:00:00:00:00:03
   Name | PC-3
   Note | (empty)
   Interfaces
   Item Name | Value
   MAC Address | 00:00:00:00:00:04
   Name | PC-4
   Note | (empty)
   Interfaces
   Item Name | Value
   MAC Address | 00:00:00:00:00:05
   Name | PC-5
   Note | (empty)

   - Device > Add Device page

   - Device > Device List page

Configuration is complete.

19 Apr 2023 14:11