I was wondering if anyone can point me in the right direction as far as possible template configurations, or specific sections of the concepts guide? I looked through the concepts guide, and tried some of it out, and still had issues.
We are a university, and ideally, I'd like to be able to have a port:
- unauthenticated - guest/student vlan
- authenticated as a student - guest/student vlan
- authenticated as staff - staff vlan
- phone authenticates with MAC (which I still need to figure out how to do) - voip vlan
I found somethings about using VSAs, but then they reference placing users in groups in AD, and then, if those users authenticate, send back a specific VLAN name, which confuses me a little, probably because we're doing it wrong.
In our environment, each building has its own VLAN, let's say building A is VLAN 1000. In the switch, that VLAN name is "buildingA" (we also have VoIP VLANs as "voice_buildingA"). Likewise, building B is VLAN 1010, building C is VLAN 1030, etc. The first thing I'm wondering is, what happens if the VLAN name the VSA is sending on auth, doesn't exist on that switch? For example. Staff member is part of the 802.1x auth group in AD. They're in buildingA, and RADIUS sends the "buildingA" VLAN name. Cool. What happens if they go to building B? RADIUS would send "buildingA", which doesn't exist on that switch stack. "buildingB" does, but not "buildingA."
Is the VSA portion necessary, or is it an overcomplication, and can everything just be done with NPS?
Sorry if this is confusing. It's just new territory, and I want to try and implement something during the summer so we can smooth it out before students return en masse. As it is right now, students can just come up to administrative buildings or classrooms, and plug right in and get full network access. Sure they need administrative credentials to access resources, but ideally they shouldn't be able to get to a lot of that in the first place.
Thanks in advance (and please be gentle).