Instant On - Wired

 View Only

  • 1.  Radius server dynamic assigned vlans

    Posted 12-12-2020 07:48 PM
    Hello,

    does anyone got expertise with Aruba 1930 Switch and dynamic vlans via Radius Server?

    yesterday i found this one year old post about radius server assigned vlans in the wireless discussion. Radius Server Assigned Vlans
    last post was "...currently doesn't support dynamic VLANs..." 

    But in the Aruba Instant On 1930 Switch Series Management and Configuration Guide (Date june2020) describe the possibility to assign dynamic vlans. 
    I already configured my Radius Server (Aruba clearpass) and establish a connection with the switch. So i can see the request on the clearpass and the rules (different VLANs for different MAC-Addresses) are working. Also the Client shows up in "Access Control Client Information" in the switch, but without any VLAN ID.

    So my concrete question, which Attribute must be send to the switch so it will put the Port in the expected VLAN? 

    ------------------------------
    best regards,
    Carsten Endrulat
    ------------------------------


  • 2.  RE: Radius server dynamic assigned vlans

    Posted 07-19-2021 02:35 PM
    Hello,

    i'm facing the same problem. The mac-based authentication is working with my (freeradius) server, but all the known attributes for VLAN assignment (tried multiple combinations): 
    Tunnel-Type = VLAN,
    Tunnel-Medium-Type = IEEE-802,
    Tunnel-Private-Group-Id = 100,
    Aruba-User-VLAN =100,
    Egress-VLANID += `%{expr: 0x31000000 + 451}`
    keep getting ignored by the Aruba 1930 switch with newest firmware. The Access Control Client Information shows all the information, but the VLANID is empty.

    We have bought multiple switches of this series exclusively, because this feature is supported..

    Has anyone had success setting up vlans via radius with the 1930?

    Regards
    Thomas

    ------------------------------
    Thomas Augustin
    ------------------------------

    Original Message


  • 3.  RE: Radius server dynamic assigned vlans

    Posted 08-10-2021 09:52 AM
    After some testing and changing server- and switch configs I got it working. I really don't know on which side the error was (maybe on both ;-)).
    Here is my working config:

    freeradius:
    aabbccddeeff    Cleartext-Password := "aabbccddeeff"
                    Tunnel-Type = 13,
                    Tunnel-Medium-Type = 6,
                    Tunnel-Private-Group-ID = 100​

    Aruba 1930:
    Security
* RADIUS Configuration
** 802.1x Authentication: enabled

* Port Access Control
** Admin Mode: enabled
** MAC Athentication Type: EAP-MD5

Port Configuration
* Control Mode: MAC Based
* VLAN Assignment: enabled
* MAC Authentication: enabled

    Some problems still remain, so after assigning a VLAN the port membership overview shows two untagged(!) VLANS on the port - the default 1 and the assigned, e.g. 100. I still have to test if this is a possible security risk or only a display error.

    Regards
    Thomas


    ------------------------------
    Thomas
    ------------------------------

    Original Message