topic Re: MHSA/MHMA automation in ExtremeSwitching (ERS)

MHSA/MHMA automation

Fijs — Mon, 04 Apr 2022 13:07:08 GMT

Hi,

We're deploying NAC in an existing network of mainly ERS49XX and ERS48XX switches.

On these ERS switches, one needs to specify if a port needs to be in MHSA or MHMA mode.

For example:

our access points need MHSA (AP authenticates, connected clients do not since they're authenticated elsewhere)
IP phones need MHMA: both the phone and the connected PC need to authenticate

Is there a way to configure MHSA/MHMA dynamically, so can configure all access ports exactly the same, and we don't have to care where to connect AP's or phones?

Thanks!

Re: MHSA/MHMA automation

Miguel-Angel_RO — Tue, 05 Apr 2022 11:46:13 GMT

Fijs,
On ERS 4900 as from 7.9.1:
Here for the ZTC for ERS:
I suggest you to read the doc ConfigFabConERS49005900_7.8.1_CG.pdf
Mig

Re: MHSA/MHMA automation

Fijs — Tue, 05 Apr 2022 15:39:27 GMT

Thanks Mig! I'll give it a try.

Re: MHSA/MHMA automation

Ludovico_Steven — Wed, 06 Apr 2022 16:28:51 GMT

So the answer above from Miguel is correct; as of 7.9.1 release you can now enable MHSA on the port via a RADIUS attribute (the same that VOSS uses).
However, for completeness, there is also the "old" ERS approach which is still possible, which is based around FA zero-touch-options.
If you enable this command for FA Client type 6 = (WAP-type1):
fa zero-touch-option auto-port-mode-fa-client client-type 6

auto-port-mode-fa-client: When this option is activated for certain FA Client types, whenever an FA client of that type is discovered on an access port, the access port is automatically pre-configured for EAP/NEAP in mode Multiple-Hosts-Single-Authentication (MHSA). The FA Client will thus need to authenticate against a RADIUS server using either EAPoL or RADIUS MAC-based authentication (NEAP).

Re: MHSA/MHMA automation

Ludovico_Steven — Mon, 11 Apr 2022 13:43:32 GMT

Got this unicast question: is this implemented also on the latest firmware for the ERS48xx series?
Replying on thread for everyone's benefit.
So the fa zero-touch-option auto-port-mode-fa-client client-type 6 is also available on ERS4800.

Whereas the new MHSA RADIUS attribute support is only on ERS5900/4900 & 3600:

ERS5900

7.9.1	SW	Extreme Dynamic MHSA RADIUS vendor specific attribute (VSA) Extreme-Dynamic-MHSA (vendor ID 1916 value 250)

ERS4900

7.9.1	SW	Extreme Dynamic MHSA RADIUS vendor specific attribute (VSA) Extreme-Dynamic-MHSA (vendor ID 1916 value 250)

ERS3600

6.5.3	SW	Extreme Dynamic MHSA RADIUS vendor specific attribute (VSA) Extreme-Dynamic-MHSA (vendor ID 1916 value 250)

Re: MHSA/MHMA automation

Fijs — Mon, 11 Apr 2022 17:42:46 GMT

Unfortunately the AP's in this case are not Extreme AP's.
So for the 49XX, an upgrade will do the trick.
For the 48XX, we'll have to manually change to MHSA for AP ports.

Re: MHSA/MHMA automation

Ludovico_Steven — Mon, 11 Apr 2022 19:26:34 GMT

Ah, yes, good point. Both approaches work with Extreme APs (Fabric Attach enabled) but if you have non-Extreme WLAN APs then you need the RADIUS MHSA attribute... or you do manual config...or even better you use Extreme WLAN !