Cisco Trunk Interface with Extreme NAC

[michael_klaus]

Dear All

I’m trying to enable Extreme NAC for Cisco switches. It works fine for Clients on Access Ports. For Accesspoints (local breakout), I’m trying to get a trunk interface with management vlan untagged and data VLANs tagged.

For XOS Switches, I would create a Role with the needed VLAN Egress config

But I cant enforce this role configuration to Cisco switches 

How can I achieve that for Cisco switches with Extreme NAC? 

[StephanH]

Hello Stefan,

with pleasure.

I am not sure if this is possilbe.

According this guide (https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_8021x/configuration/15-e/sec-usr-8021x-15-...)

“The VSA changes the authenticator switch port mode from access to trunk and enables 802.1X trunk encapsulation and the access VLAN (if any) would be converted to a native trunk VLAN. VSA does not change any of the port configurations on the supplicant.”

it sound there is no vlan change available.  But it’s not 100% clear if an additional vsa can send the vlan IDs. Like you configured for vlan 999.

Do you still these lines in the debug from your switch?

Oct 13 08:11:15.165: RADIUS:  Vendor, Cisco       [26]  19  
Oct 13 08:11:15.165: RADIUS:   Cisco AVpair       [1]   13  "vlan-id=999"
Oct 13 08:11:15.165: RADIUS:  Vendor, Cisco       [26]  18  

This entry point to the vlan send by NAC.

Best regards

Stephan

[michael_klaus]

Hi Stephan

After changing to “Cisco-AVPair=”, the Ports gets configured as a trunk port. So next step will be to check if I can send native and allowed vlans via Radius attribute.

thanks a lot 

[StephanH]

Hello Michael,

one additional point. You can try to change “cisco-avpair=” to “Cisco-AVPair=”.

I think there was at least in the past a dependence on upper and lower case letters.
 

Regards

Stephan

[StephanH]

Hello Michael,

sorry I saw some of my text is missing on my replay. The following was missing:

Only if you enable “Client Information Signaling Protocol (CISP)” on your switch you can change the port type via Radius according the Network Edge Authentication Topology (NEAT).

Do you have enabled CISP?

Regards

Stephan

[StephanH]

Hello Michael.

the Cisco Ethernet Interface Type (= Access or Trunk Port) can’t configured via Radius attributes.

This is independet of the Radius-Server or NAC-Vendor. Cisco does not offer the possibility to switch over via radius protocol.

This is because unlike other vendors, Cisco explicitly distinguishes the port type, while others simply distribute tagged and untagged VLANs. Which is again provided for in the radius protocol.

If you need an dynamic change between Trunk and Access Port and the standard configuration ist Access Port you can enable authentication, and trigger a script on XMC if a access point is is recognized. This script hast to change the Cisco port Config and do an reauth.

Regards

Stephan