topic Re: VPEX with netlogin mac in ExtremeSwitching (EXOS/Switch Engine)

VPEX with netlogin mac

Benjamin_Kümmel — Thu, 24 Sep 2020 01:48:09 GMT

Hello,

some days ago we have built up our first vpex enviroment with netlogin mac enabled ports and redundant controller bridges. Allthought the netlogin request is positively answered by the nac-server the port goes in unautheticated state.

In the gtac kwonledge base I found the following article https://extremeportal.force.com/ExtrArticleDetail?an=000086551 which give hints on a enabled policy. What we have to do to solve our problem?

Benjamin

Re: VPEX with netlogin mac

Stefan_K_ — Thu, 24 Sep 2020 17:00:24 GMT

Can you provide us the output of the following commands

show netlogin session ports 106:9
show configuration netlogin
show configuration policy

Do you see the client in the NAC End-Systems table?

Re: VPEX with netlogin mac

Benjamin_Kümmel — Fri, 25 Sep 2020 01:47:10 GMT

Hello Stefan,

thank you for your demand. Here are the informations:

* (orchestration cb-schloss-02) Slot-1 VPEX cb-schloss-01.7 # sh netl por 106:9
Port                          : 106:9
Port Restart                  : Disabled
Allow Egress                  : Broadcast, Unicast
Vlan                          : vlan-mag-reykjavik
Authentication                : mac-based
Port State                    : Enabled
Authentication Mode           : Required (Policy Enabled only)
Max Supported Users           : 24576 (Policy Enabled only)
Allowed Users                 : 128 (Policy Enabled only)
Current Users                 : 0 (Policy Enabled only)
Auth Failure Vlan             : Disabled
Auth Service-Unavailable Vlan : Disabled
------------------------------------------------
        MAC Mode Port Configuration
------------------------------------------------
Re-authentication period      : 3600
Re-authentication             : Off
Authentication Delay          : 0 seconds (Default)
------------------------------------------------
        Netlogin Clients
------------------------------------------------

MAC IP address Authenticated Type ReAuth-Timer User
-----------------------------------------------
(B) - Client entry Blackholed in FDB

Number of Clients Authenticated : 0
* (orchestration cb-schloss-02) Slot-1 VPEX cb-schloss-01.8 # sh conf netlogin
#
# Module netLogin configuration.
#
configure netlogin vlan dummy
enable netlogin mac
configure netlogin mac authentication database-order radius
enable netlogin ports 106:9 mac
configure netlogin ports 106:9 mode mac-based-vlans
configure netlogin ports 106:9 no-restart
configure netlogin ports 106:9 allow egress-traffic all_cast
configure netlogin add mac-list ff:ff:ff:ff:ff:ff 48
* (orchestration cb-schloss-02) Slot-1 VPEX cb-schloss-01.9 # sh conf polic
#
# Module policy configuration.
#
* (orchestration cb-schloss-02) Slot-1 VPEX cb-schloss-01.10 #

I’ve seen the need to use policies. I hope that this feature is easy to implement.

Greetings

Benjamin

Re: VPEX with netlogin mac

Miguel-Angel_RO — Fri, 25 Sep 2020 05:09:00 GMT

Benjamin,

Have a look here: https://extremeportal.force.com/ExtrArticleDetail?an=000077264

Your radius seems to be answering with a policy name starting with “enterprise...” but the screenshot is cutting the end of the name. This name is the TestPolicy in the example.

Mig

Re: VPEX with netlogin mac

Benjamin_Kümmel — Fri, 02 Oct 2020 16:45:36 GMT

Hello,

thank for the hint on the polices. With this info in mind I was able to create a good solution on our Extreme Management Center.

Greetings

Benjamin

Re: VPEX with netlogin mac

Miguel-Angel_RO — Fri, 02 Oct 2020 18:51:41 GMT

Very good,

Please share you solution to help the community!

thanks

Mig

Re: VPEX with netlogin mac

Benjamin_Kümmel — Tue, 20 Oct 2020 02:10:58 GMT

Hello,

here some words about my solution. As I’ve read now I need policies to solve my netlogin-problem in a vpex enviroment.

The first step was to enable policies on the switches and add some snmp write credentials so that the emc can push the policies to the switches.

Now I created on the emc a new empty policy domain and created one new policy role to give full access by permitting traffic. After saving these simple settings I distributed the policy to the switches by adding the newly created policy domain to the switches. Before that it was neccesary to add the new write credentials to the access profile.

After that I modified the given nac-configuration and modified the rules that emc now gives back the allow all policy to switches instead the enterprise user policy after a successful request.

Benjamin

Re: VPEX with netlogin mac

DrankThePurpleS — Sat, 02 Jan 2021 16:03:23 GMT

I was definitely not expecting to find something so specific to just one issue but a very important one.

If you don’t mind, how Control Bridges, vs v400’s? I just scrolled through a pretty hilarious proof of concept document. Showed a stack of x690’s as CB for I believe 2 v4000’s, when up to 8 v400s they obviously implemented a stack 440s for redundancy. Went into great detail about OSPF, which I might be look at is overkill here. In these models, VRRP, Stacked CBs, connected to v400s. OSPF only has one path.

Even though this company was sold this model based on a lot of false information, from XIQ CB to The BoM they built being CB here might add 24 port 590 there, but no need for it do do anything in the other buildings it’s serving, so keep layer 3 away as much as possible. Turn on XMC, NAC, EA, and looking this demo, gorgeous fingerprint, shows all this with this license IA hen you can posture, and shoot lasers at guests.