topic Re: EXOS VSA 211 untagged not working in ExtremeSwitching (EXOS/Switch Engine)

EXOS VSA 211 untagged not working

netjradm — Tue, 30 Jan 2024 08:28:00 GMT

Hi,

i'm trying to authenticate client via dot1x (EAP-TLS), RADIUS and netlogin.
Our Radius Server is sending the VSA211 Attribute in the Accept Message but the EXOS Switch does not put the Client in the specified VLAN.

Radius Attribut:
Extreme-Netlogin-Extended-Vlan=U5

Wireshark Capture:

exos debug

when i configure the radius server to send the vlan via Tunnel-Group-ID the end device is moved to the correct vlan.

wireshark capture

netlogin debug

Switch Config:

configure radius netlogin primary server XXX.XXX.XXX.XXX 1812 client-ip XXX.XXX.XXX.XXX vr VR-Default
configure radius netlogin primary shared-secret encrypted "secret"
configure radius netlogin secondary server XXX.XXX.XXX.XXX 1812 client-ip XXX.XXX.XXX.XXX vr VR-Default
configure radius netlogin secondary shared-secret encrypted "secret"
configure radius dynamic-authorization 1 server XXX.XXX.XXX.XXX client-ip XXX.XXX.XXX.XXX vr VR-Default shared-secret encrypted "secret"
configure radius dynamic-authorization 2 server XXX.XXX.XXX.XXX client-ip XXX.XXX.XXX.XXX vr VR-Default shared-secret encrypted "secret"
enable radius
disable radius mgmt-access
enable radius netlogin
enable radius dynamic-authorization
enable netlogin dot1x
enable netlogin ports 3-8 dot1x

Re: EXOS VSA 211 untagged not working

OscarK — Tue, 30 Jan 2024 13:15:51 GMT

Have you enabled policy (I assume so as you have dynamic authorization enabled) ?

If so, then EXOS does not honor VSA211, only the attributes mentioned in the userguide for policy and only if you enable maptable response both and vlanauthorization.

Re: EXOS VSA 211 untagged not working

netjradm — Thu, 01 Feb 2024 14:13:53 GMT

yes i have configured one policy for the ap's ( Tagging multiple vlans and activate auth override)
So the VSA211 only works when there is no policy on the switch?

Re: EXOS VSA 211 untagged not working

OscarK — Tue, 06 Feb 2024 13:34:52 GMT

yes., but as you can assign vlans through the policy itself (pvid) you don't need VSA 211. Checkout table 114 in the userguide for vsa's supported with OnePolicy enabled.

Table 114: Supported Access-Accept Attributes for ONEPolicy