Fabric Engine NAC Voice VLAN tagged and daisy channed client

Thomas_Gfeller — Thu, 13 Aug 2026 15:03:01 GMT

I need to configure the Fabric Engine Access Port and Control Policy Mapping for VOIP devices. The port should be tagged in the voice vlan and also the switch should tell the VOIP device about the tag by LLDP MED. Behind the VOIP device we need to connect end device which should be put in untagged vlan.

My switch/ radius config looks like this:

radius server host x.x.x.x key ****** used-by eapol priority 1
radius enable
radius accounting enable
radius dynamic-server client x.x.x.x secret ****** enable
radius reachability mode use-radius
auto-sense wait-interval 2
#
# EAP CONFIGURATION
#
eapol enable
#
# PORT CONFIGURATION
#
interface GigabitEthernet 1/2
auto-recover-port enable
spoof-detect enable
auto-sense enable
name "NAC"
no shutdown
slpp-guard enable
eapol multihost mac-max 8192
eapol multihost eap-mac-max 32

eapol multihost non-eap-mac-max 32

Thanks for any help or best preactice advise.

Thomas

Re: Fabric Engine NAC Voice VLAN tagged and daisy channed client

Olini — Fri, 14 Aug 2026 16:43:22 GMT

We use RADIUS attributes for this. When the VoIP phone authenticates, it receives its VLAN and I-SID using the Extreme-Dynamic-Client-Assignments RADIUS attribute VSA. The port is in MHMA mode, and the client behind the phone is authenticated separately and assigned using the same VSA (different VLAN and I-SID).

topic Re: Fabric Engine NAC Voice VLAN tagged and daisy channed client in ExtremeControl

Fabric Engine NAC Voice VLAN tagged and daisy channed client

Re: Fabric Engine NAC Voice VLAN tagged and daisy channed client