NAC - location based VLAN Assignment

[Thomas_Hilber]

We are using Extreme NAC as Proxy Radius with Microsoft NPS.
At the moments VLANs are assigned based on radius response from NPS which is working fine.

What we would like to do now is the following:

1. NPS responds with vlan name "client" if end system is successfully authenticated.
2. on switch1, if NPS response is "client" - vlan should be "client_1"
3. on switch2, if NPS response is "client" - vlan should be "client_2"
4. on switch3, if NPS response is "client" - vlan should be "client_3"
5. and so on

So based on switch location group we want modify the vlan information from NPS for the final assignment of the end system.
Is this possible to implement with Extreme NAC?

[Ryan_Yacobucci]

This is the way I would recommend to do it: 

1. NAC rule for Printers: 

2 Policy Mapping for Printers has multiple mappings with location group per switch: 






All printers will hit the "Printer" rule and NAC will send different RFC 3580 VLAN authorizations based on the switch that sent the authentication request. 



Brian's solution is a one too. If Policy VLAN islands or policy isn't supported by the older or 3rd party devices as long as they can process an RFC 3580 VLAN authorization with VLAN name instead of VLAN ID you can configure the same VLAN name on all switches, and map it to a different VLAN ID per switch. 

So:
Switch 1 would would have "Printer" VLAN be VLAN 1
Switch 2 would would have "Printer" VLAN be VLAN 2
Switch 3 would would have "Printer" VLAN be VLAN 3

NAC would always send back RFC 3580 VLAN NAME (Printer), and the individual switch can provision the unique VLAN per switch accordingly. 

Policy VLAN Islands just makes it easy to deploy and manage this type of configuration. 

[Ryan_Yacobucci]

Hello,

Yes, NAC has the ability to provide a different authorization based on location group by utilizing location based policy mappings. 

You will have one rule that has one profile that mappings to a number of policy mappings that are used based on location criteria within the policy mapping itself.

For instance: 

Unregistered with "Map to Location" "Any"



Unregistered with "Map to location" "XCC". XCC being the IP address of the XCC controller. 


So there are two policy mappings named "Unregistered", but if the XCC controller sends the RADIUS access request NAC will send a different policy named based on the policy mapping:



So NAC would send "Unregistered role for BCS_WIRELESS" as the filter-id ONLY to the XCC. Any other switch would have the filter-id of "Unregistered" sent. 

So you would create a new policy mapping for each switch location group, and define the switches inside the location group.

You'll probably be working with RFC 3580 for VLAN authorization. There is no difference. Instead of filer-id you would send a different VLAN ID. 

So: 

policyMappingName - Location group: switch 1 - VLAN 1
policyMappingName - Location group: switch 2 - VLAN 2
policyMappingName - Location group: switch 3 - VLAN 3
policyMappingName - Location group: switch 4 - VLAN 4


They key is that the policy mapping name must all be the same, and you should leave one of the policy mappings set to location of "any" or NAC will throw an error on enforce saying that there is no default policy mapping. 

Thanks
-Ryan

[Thomas_Hilber]

Hi Ryan,

thank you this could be the way to go.

But is NAC also capable to evaluate the VLAN name returned with  RFC 3580 from NPS server.

Because we could also have the following situation when the end system is a printer:
1. NPS responds with vlan name "printer" if end system is successfully authenticated.
2. on switch1, if NPS response is "printer" - vlan should be "printer_1"
3. on switch2, if NPS response is "printer" - vlan should be "printer_2"
4. on switch3, if NPS response is "printer" - vlan should be "printer_3"
5. and so on

So it would be a two stage process:
first look into vlan returned by NPS
then assign the "new" vlan name based on switch location

[PeterK]

why are you proxying the requests to the NPS? What values and sources uses the NPS for decision?

From my current point of view, it would be much easier for you, to only use the NAC.
I don't know if NAC is able to modify the vlan-tunnel-atribute received from the NPS.