topic How should configuration for multiple 802.1x sesions look like on x440? in ExtremeSwitching (EXOS/Switch Engine)

How should configuration for multiple 802.1x sesions look like on x440?

MarekorMark — Fri, 17 Dec 2021 16:31:00 GMT

Hi
I need to configure switch port for AP. On AP i will broadcast wireless network based on 802.1x authentication.
probably i shud see multiple user netlogin sesions on that port. Now what i see is onlu 1 policy applied for accesspoint and meny sesions whitout any policy applied.

it look like that:

test-switch-11.15 # sh netlog session por 3
Multiple authentication session entries
---------------------------------------

Port : 3 Station address : 00:dc:b2:39:d4:12
Auth status : failed Last attempt : Fri Dec 17 13:03:41 2021
Agent type : dot1x Session applied : false
Server type : radius VLAN-Tunnel-Attr : None
Policy index : 0 Policy name : No Policy applied
Session timeout : 0 Session duration : 0:00:00
Idle timeout : 300 Idle time : 0:00:00
Auth-Override : disabled Termination time : Not Terminated

Port : 3 Station address : 00:dc:b2:39:d4:12
Auth status : success Last attempt : Fri Dec 17 12:57:51 2021
Agent type : mac Session applied : true
Server type : radius VLAN-Tunnel-Attr : None
Policy index : 33 Policy name : 0-ACCESSPOINT Auth (active)
Session timeout : 0 Session duration : 1:14:18
Idle timeout : 300 Idle time : 0:00:00
Auth-Override : disabled Termination time : Not Terminated

Port : 3 Station address : 4c:eb:42:e8:af:e9
Auth status : failed Last attempt : Fri Dec 17 12:27:50 2021
Agent type : dot1x Session applied : false
Server type : radius VLAN-Tunnel-Attr : None
Policy index : 0 Policy name : No Policy applied
Session timeout : 0 Session duration : 0:00:00
Idle timeout : 300 Idle time : 0:00:00
Auth-Override : disabled Termination time : Not Terminated

Accesspoint is autenticated by MAC and applied role contains one nativ vlan for AP management and multiple egress vlans.

Additionally when im connecting to wireless network im reciveing proper role on AP whitch my Xtreme Campus controler apply to that connection - but when im looking at Xtreme Network Management End systems it looks like after few minutes my session was deautenticated by switch

I dont know how to fix it to make 802.1x stable and autenticate user only by it

RE: How should configuration for multiple 802.1x sesions look like on x440?

RonaldW — Sat, 18 Dec 2021 10:48:00 GMT

Hi Marek,

Normally you would not expect your wireless clients being authenticated on the switchport. This is done by the AP.
Make sure that the "AP Aware" option is enabled on the AP's policy. This should overcome this issue. Now only your AP should be authenticated on the wired.

You could prevent the port from reauthenticating by sending a idle timeout attribute;

RE: How should configuration for multiple 802.1x sesions look like on x440?

MarekorMark — Sat, 18 Dec 2021 22:50:00 GMT

I did the 1st thing and set the AP Aware to enable but secound thing is harder to set 'couse i dot have that option

I have Extreme Management Center 8.5.6.17

RE: How should configuration for multiple 802.1x sesions look like on x440?

RonaldW — Sat, 18 Dec 2021 23:08:00 GMT

And, did the first part work? Did you lose the client netlogin sessions?

For the second part, you might need to switch to the advance view?

It could also be that you'll need to change the "attributes to send", depending on what is configured there.

RE: How should configuration for multiple 802.1x sesions look like on x440?

MarekorMark — Sat, 18 Dec 2021 23:29:00 GMT

When i enabled AP aware - host could't connect to the network. after disable it - hos connected to network

i switched to advace view and set Idle-Time and after that - accesspoints look like authenticated but XCC cant see them

* test-switch-14.11 # sh netlogin session
Multiple authentication session entries
---------------------------------------

Port : 41 Station address : 00:dc:b2:38:61:1f
Auth status : success Last attempt : Sat Dec 18 21:22:23 2021
Agent type : mac Session applied : true
Server type : radius VLAN-Tunnel-Attr : None
Policy index : 17 Policy name : 0-ACCESSPOINT Auth (active)
Session timeout : 0 Session duration : 0:01:39
Idle timeout : 300 Idle time : 0:00:00
Auth-Override : disabled Termination time : Not Terminated

RE: How should configuration for multiple 802.1x sesions look like on x440?

RonaldW — Sun, 19 Dec 2021 01:57:00 GMT

Are u sure that your clients get the right VLAN's assigned on the WLAN AP? And is this traffic tagged as it should on the AP's interface?
How did you learn the mac addresses on the switch when you had AP Aware disabled?

------------------------------
- Ronald
------------------------------

RE: How should configuration for multiple 802.1x sesions look like on x440?

MarekorMark — Sun, 19 Dec 2021 21:40:00 GMT

This is my configuration and somehow it stopped work properly

RE: How should configuration for multiple 802.1x sesions look like on x440?

MarekorMark — Sun, 19 Dec 2021 22:31:00 GMT

And this is what ive got by enable ap aware on AP rouler

ru_sentinel? port?

RE: How should configuration for multiple 802.1x sesions look like on x440?

MarekorMark — Sun, 19 Dec 2021 23:06:00 GMT

OK ive got it.

AP Aware - disabled

on switch - conf netlo idle 0
on switch - ports restarted - and sesion is stable - users stays in proper group 🙂

RE: How should configuration for multiple 802.1x sesions look like on x440?

MarekorMark — Mon, 20 Dec 2021 10:55:00 GMT

better way to send Idle-Timeout attribute (IMO) is to do like in link below

https://extremeportal.force.com/ExtrArticleDetail?an=000079217

by creating new profile od "Radius attributes to send" by copy them from "RFC 3580 - VLAN and Extreme Policy" and adding last line "idle-timeout"

Filter-Id=Enterasys:version=1:%MANAGEMENT%policy=%POLICY_NAME%
Service-Type=%MGMT_SERV_TYPE%
Tunnel-Private-Group-Id=%VLAN_ID%:%VLAN_TUNNEL_TAG%
Tunnel-Type=13:%VLAN_TUNNEL_TAG%
Tunnel-Medium-Type=6:%VLAN_TUNNEL_TAG%
Idle-Timeout=%CUSTOM4%

after that i modiefied custom 4 field by writing "0" only

somehow editing policy mapping custom 4 attribute by placing there "idle-timeout=0" didnt work on every switch - i dont know why