topic Re: Assigning two vlans to X440-port via 802.1X and Windows NPS in ExtremeSwitching (EXOS/Switch Engine)

Assigning two vlans to X440-port via 802.1X and Windows NPS

mani — Fri, 10 May 2019 14:48:09 GMT

Hi,

I am currently configuring configuring 802.1X on all of our Switches. We have Cisco IP-phones and Desktop PCs that are connected via the phone to to the switch. The ports should be set to the voice vlan tagged and the production vlan untagged.
The problem i have is, that only the last entry on the NPS gets set on the port, and not both.

So in this case, Production gets assigned on the Port, but i actually want both options set. Does anyone have experiences with this and is there a way to solve this?

Thanks in advance!

Re: Assigning two vlans to X440-port via 802.1X and Windows NPS

Ronald_Dvorak — Fri, 10 May 2019 15:12:41 GMT

Hi,

is mac-based-vlans configured.

https://gtacknowledge.extremenetworks.com/articles/Q_A/What-is-MAC-based-VLANs-and-port-based-VLANs

If that doesn't help please post the current 802.1X config so we'd take a look.

-Ron

Re: Assigning two vlans to X440-port via 802.1X and Windows NPS

mani — Fri, 10 May 2019 15:41:43 GMT

@Tomasz

(oh you removed your reply)

ID 26 is not a VSA, i think 26 is just something NPS specific:

I followed this guide and prepending T or U in front of the VLAN differentiates between tagged, untagged:
https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-configure-802-1x-based-Netlogin-with-Radius-on-EXOS

I will try out RFC3580-based Tunnels now and see if that works.

Re: Assigning two vlans to X440-port via 802.1X and Windows NPS

Tomasz — Fri, 10 May 2019 15:47:41 GMT

@mani yes, after I wrote it I thought that I missed the point in your question. 😉
I think you should try Ron's suggestions as well.
Yet still working, VSA-based VLAN assignment is not used today I believe, depends on what version of EXOS do you use.

Kind regards,
Tomasz

Re: Assigning two vlans to X440-port via 802.1X and Windows NPS

mani — Fri, 10 May 2019 15:49:10 GMT

code:

create vlan nt_login
configure netlogin vlan nt_login
enable netlogin dot1x
enable netlogin ports 10 dot1x
configure radius netlogin primary server "server" client-ip "client" vr "VR-Default"
configure radius netlogin primary shared-secret ****
enable radius netlogin

I think currently only port-based-vlans is configured, i just used port10 as my testing port.
My first idea was to just authenticate the PC and then set the port to vlan VOIP and Production so PC and Phone is allowed. But by reading trough this, i think i need to authenticate the PC and the Phone and use both tagged? Or am i wrong.

edit:
I think i understand what mac-based-vlan does, but how does the authentication side on NPS work, because i want to authenticate the PC via Username or Certificate. And how do i do the phones?

Re: Assigning two vlans to X440-port via 802.1X and Windows NPS

Ronald_Dvorak — Fri, 10 May 2019 21:55:09 GMT

From my experience most configure it to put the phone in a untagged VLAN and the PC as tagged but I don't see a problem to tag both.

You'd use whatever 802.1X auth the phone support, state of the art phones should support a lot of different methods e.g. PEAP, EAP-TLS.
In case nothing is supported you'd end up with just MAC auth..

-Ron