topic Re: Fabric Engine NAC Voice VLAN tagged and daisy channed client in ExtremeControl

Fabric Engine NAC Voice VLAN tagged and daisy channed client

Thomas_Gfeller — Thu, 13 Aug 2026 15:03:01 GMT

I need to configure the Fabric Engine Access Port and Control Policy Mapping for VOIP devices. The port should be tagged in the voice vlan and also the switch should tell the VOIP device about the tag by LLDP MED. Behind the VOIP device we need to connect end device which should be put in untagged vlan.

My switch/ radius config looks like this:

radius server host x.x.x.x key ****** used-by eapol priority 1
radius enable
radius accounting enable
radius dynamic-server client x.x.x.x secret ****** enable
radius reachability mode use-radius
auto-sense wait-interval 2
#
# EAP CONFIGURATION
#
eapol enable
#
# PORT CONFIGURATION
#
interface GigabitEthernet 1/2
auto-recover-port enable
spoof-detect enable
auto-sense enable
name "NAC"
no shutdown
slpp-guard enable
eapol multihost mac-max 8192
eapol multihost eap-mac-max 32

eapol multihost non-eap-mac-max 32

Thanks for any help or best preactice advise.

Thomas

Re: Fabric Engine NAC Voice VLAN tagged and daisy channed client

Olini — Tue, 18 Aug 2026 17:06:17 GMT

We use RADIUS attributes for this. When the VoIP phone authenticates, it receives its VLAN and I-SID using the Extreme-Dynamic-Client-Assignments RADIUS attribute VSA. The port is in MHMV mode, and the client behind the phone is authenticated separately and assigned using the same VSA (different VLAN and I-SID).

Re: Fabric Engine NAC Voice VLAN tagged and daisy channed client

Thomas_Gfeller — Mon, 17 Aug 2026 12:55:20 GMT

Hi Olini

Thanks for reply, does both VOIP and Client using the same VLAN/ I-SID ID? are they both untagged?

Thanks

Thomas

Re: Fabric Engine NAC Voice VLAN tagged and daisy channed client

brattlund89 — Tue, 18 Aug 2026 10:49:07 GMT

If you configure auto-sense voice settings it will advertise the voice VLAN over LLDP-MED (assuming the phone gets identified as a phone by LLDP):

auto-sense voice i-sid 10100 c-vid 100

If using RADIUS authentication, the RADIUS reply should just be an accept in this case, and the phone should end up in the voice VLAN tagged. If you don't want to RADIUS-authenticate the phone, you can bypass RADIUS for phones using "auto-sense eapol voice lldp-auth".

Link to section in the user guide: Fabric Engine v9.3 User Guide

For the client device connected behind the phone, you can either:

Configure a data-vlan for auto-sense using "auto-sense data i-sid 100200". In this case the switch will place the client device on the data-vlan after it gets a RADIUS accept, unless a specific VLAN is returned by the RADIUS server.
Leave data-vlan unconfigured and have the RADIUS server return the VLAN attributes.

Re: Fabric Engine NAC Voice VLAN tagged and daisy channed client

Olini — Tue, 18 Aug 2026 16:59:42 GMT

Hi Thomas,

in our case its different VLANs/I-SIDs, on the same port (transparent to the devices). Here is the documentation for this: https://documentation.extremenetworks.com/VOSS/SW/90/VOSSUserGuide/GUID-385E2C11-3642-494E-8A17-127344722CA6.shtml

Kind regards

Oli

Re: Fabric Engine NAC Voice VLAN tagged and daisy channed client

Thomas_Gfeller — Wed, 19 Aug 2026 13:19:09 GMT

Thank you both, in my case i will use auto-sense, but also good to know there is another method 🙂

Thomas

Re: Fabric Engine NAC Voice VLAN tagged and daisy channed client

Olini — Thu, 20 Aug 2026 14:25:13 GMT

All fine. We have fairly high security standards and didn‘t want to trust in the lldp advertisements of an unauthorized device, thats all.

Br Oli