topic Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG? in Aerohive Migrated Content

Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

AnonymousM — Tue, 20 Aug 2019 14:05:12 GMT

Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

samantha_lynn — Tue, 20 Aug 2019 20:10:56 GMT

That would be quite a few commands, and CLI configuration isn't supported. Can I ask why you aren't using the GUI to implement these settings?

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

AnonymousM — Tue, 20 Aug 2019 20:16:32 GMT

Hi Sam,

as the option is no longer available in Hivemanager NG as far as I know.

In Hivemanager Classic this option was at:

Network Policy --> Additional Settings

At Hivemanager NG I haven't found it.

Best regards,

Sebastian Heise

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

samantha_lynn — Tue, 20 Aug 2019 22:01:31 GMT

If you go to Configure> Open the Network Policy> Go to the Device Templates tab within the Network Policy> Go to the Switch Templates sub-tab> Port configuration (left hand side menu)> Select a port> Assign> Create New> Scroll down and go to the Wired Connectivity sub-tab> Toggle User Authentication to ON, these should be equivalent settings for a secure port in HiveManager NG. Is that what you're looking for?

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

AnonymousM — Wed, 21 Aug 2019 12:09:18 GMT

I don't think this is the right feature, as I have to assign a Radius server, which is normally not needed. Also this feature is only available when the port is used as an access port, but for me it has to stay as uplink port.

Attached you can find a screenshot of the settings I had to set in the Hivemanager classic, I hope this helps.

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

reinhardg — Fri, 11 Oct 2019 18:55:23 GMT

Probably the commands are:

supplicant name_of_supplicant

supplicant name_of_supplicant username username password ***

interface eth0 supplicant name_of_supplicant

interface eth1 supplicant name_of_supplicant

I looked into an APs config created with HM classic. With HM (NG) I didn't find the settings, too.

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

s_heise — Fri, 11 Oct 2019 19:09:32 GMT

Hello Gunter,

thank you for the feedback, unfortunately I don't have the command supplicant.

Which firmware are you using?

We have 6.5r12 on the AP141.

Best regards,

Sebastian

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

reinhardg — Fri, 11 Oct 2019 19:36:06 GMT

Hello Sebastian,

we have HiveOS V8.2r6. Are you sure that this worked with HM classic and AP141 with 6.5r12? (I had a look into the latest CLI-guide for AP141 and didn't find anything usefull. However, it's for V6.5r11.)

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

s_heise — Mon, 14 Oct 2019 15:31:21 GMT

Hello Gunter,

I am sure it worked, as I had proper authentication of the APs on the Cisco ISE with the username configured over the HM Classic.

That's why I am curious, that there are no CLI commands for this settings and that I wasn't able to see it in the configuration.

Best regards,

Sebastian

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

reinhardg — Mon, 14 Oct 2019 17:40:42 GMT

That's indeed curious. Are all of your APs of type AP141? Maybe you have seen the auth of another AP on your Cisco ISE?

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

s_heise — Mon, 14 Oct 2019 19:52:02 GMT

Most of the devices are AP141, we have only 4 other types. These have the firmware 10. and there I can find the CLI command.

Regarding the authentication I could see that the AP141 is authenticating, as they can be identified by IP and MAC.

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

reinhardg — Tue, 15 Oct 2019 15:41:28 GMT

In the CLI-guide of for example AP130 and version 6.6r1 I found the "supplicant" command. So it looks like this command was introduced with that version. I'm sorry, but I have no idea how to configure 802.1x port security with the older versions. I wonder why no one from Aerohive gives a statement to this.

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

s_heise — Tue, 15 Oct 2019 19:34:59 GMT

That's true, Aerohive doesn't provide a statement on this post, on my case with our distributor and also not in direct contact.

At least they should know it better...

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

samantha_lynn — Tue, 15 Oct 2019 19:46:35 GMT

Unfortunately we don't support CLI configuration, only GUI configurations. I'm sorry we couldn't be more helpful here.

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

reinhardg — Wed, 16 Oct 2019 14:34:08 GMT

@Sebastian:

In case you still have an AP141 that was configured with HM-classic you could try "show config current". That should show the complete config including default settings. Maybe you then can identify the according cmds... What were the answers of your distributor and your direct contact?

@Sam:

Would you please submit a feature request making it possible to configure secure port with the GUI of NG?

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

s_heise — Wed, 16 Oct 2019 14:42:53 GMT

I have checked a configured device in Hivemanager Classic and nowhere in the config I could found anything regarding this feature. The configured username for example appeared nowhere in the running config, also the term supplicant was missing.

The last questions from them where:

Which switchtype is used and how is the port configured?

Distributor (which also opened a case at Aerohive) and the direct Aerohive contact stopped responding...

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

bpowers — Wed, 16 Oct 2019 18:58:27 GMT

While I respect that statement @Sam Pirok , I am now curious as to why Supplemental CLI was ever implemented as an option if using it is not supported by Aerohive. That was how it was pitched to us years back. A way to configure things the hardware was capable of but the GUI lacked at present. That and a way to alter settings on a subset of APs without impacting the whole by editing a more global object.

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

bpowers — Wed, 16 Oct 2019 19:25:58 GMT

So on HiveOS8.4r2, the above commands @Gunter Reinhard provided are correct.

As these were added to a config audit of an AP - albeit an AP230.

supplicant BP-Office

supplicant BP-Office username bob

supplicant BP-Office password ******

supplicant BP-Office eap-type md5

But as soon as I swap the HiveOS over to 6.5r12, those commands are not part of the config audit.

I simply do not know how you were doing this on the 6.5 train of code @Sebastian Heise. And with the AP141 not having a HiveOS 8.x code base I'm even more perplexed. I'm doing this testing on the legacy HM platform, so I'm struggling to see how those settings under Network Policy --> Additional Settings worked for you on the 6.5 code base for the older .11n based APs.

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

s_heise — Wed, 16 Oct 2019 19:59:57 GMT

Yes, I'm struggling with it too, but I'm 100% sure that I was able to see working authentications.

Re: Can please someone provide the commands needed to configure Secure Port Settings via Supplemental CLI in Hivemanager NG?

bpowers — Wed, 16 Oct 2019 20:04:01 GMT

Did you use HMOL or did you have an on-prem HM Classic platform? Or I guess I'm curious if you still have access to that platform. To move a single device back to it and gather a bit more information so we can see what's going on...