topic RE: HP ProCurve 802.1x Session Timeout - Idle Timeout via RADIUS Attribute possible ? in ExtremeWireless (General)

HP ProCurve 802.1x Session Timeout - Idle Timeout via RADIUS Attribute possible ?

M_Nees — Thu, 18 May 2017 14:31:00 GMT

On a current project we use HP2920 Switches with Extreme Management and Control.

For avoid problems with printers we use "aaa port-access authenticator X/X logoff-period xxxxx"

For VoIP Phones we use a triggered Re-Authentication with "aaa port-access authenticator X/X reauth-period XXXXX"

Because this commanda are port related and not as i prefer device or mac related i want to switch over to apply these Timer values via Standard RADIUS Attributes during Authentication process (as i do that with EXOS / EOS sswitches).

Is this working ? I do not see anywhere the information if this is possible NOR the negativ information that this is not working.
During tests it seem the HP does not understand these Attributes. Are there maybe special HP VSA ?

These link is a good information source but does not explain my question:
https://wiki.freeradius.org/vendor/HP

Anyone how try this successfully before ?

Regards

RE: HP ProCurve 802.1x Session Timeout - Idle Timeout via RADIUS Attribute possible ?

M_Nees — Wed, 24 May 2017 16:40:00 GMT

Nobody out there who has ever try that ?

RE: HP ProCurve 802.1x Session Timeout - Idle Timeout via RADIUS Attribute possible ?

M_Nees — Tue, 11 Jul 2017 01:55:00 GMT

After 2 months HP Support have an answer:
I have been able to successfully change the Session-Timeout(27) value on the switch by sending a value (greater than 60sec) in the radius Accept-Accept message together with the Termination-Action (set to “1”), and the switch does take this new value into account.

However when sending the Idle-Timeout, the switch doesn’t react to the new value. The Lab confirmed that this one cannot be changed. Changing the Idle-Timeout value is not supported. Unfortunately, there are no HPE specific Attributes (VSA) available which would do the same.

I am glad for this help - but waiting 2 months for that answer is not what i am accustomed by Extreme GTAC ;-)))

Hope this helps any other guy who working with Extreme NAC and 3rd Party switches.

Regards

RE: HP ProCurve 802.1x Session Timeout - Idle Timeout via RADIUS Attribute possible ?

Drew_C — Tue, 11 Jul 2017 01:55:00 GMT

Sorry the community let you down on this one, Matthias. Glad you found an answer though!