Fabric Engine NAC Voice VLAN tagged and daisy channed client

[Thomas_Gfeller]

Hi

I need to configure the Fabric Engine Access Port and Control Policy Mapping for VOIP devices. The port should be tagged in the voice vlan and also the switch should tell the VOIP device about the tag by LLDP MED. Behind the VOIP device we need to connect end device which should be put in untagged vlan.

My switch/ radius config looks like this:

radius server host x.x.x.x key ****** used-by eapol priority 1
radius enable
radius accounting enable
radius dynamic-server client x.x.x.x secret ****** enable
radius reachability mode use-radius
auto-sense wait-interval 2
#
# EAP CONFIGURATION
#
eapol enable
#
# PORT CONFIGURATION
#
interface GigabitEthernet 1/2
auto-recover-port enable
spoof-detect enable
auto-sense enable
name "NAC"
no shutdown
slpp-guard enable
eapol multihost mac-max 8192
eapol multihost eap-mac-max 32

eapol multihost non-eap-mac-max 32

Thanks for any help or best preactice advise.

Thomas

[brattlund89 · Accepted solution]

If you configure auto-sense voice settings it will advertise the voice VLAN over LLDP-MED (assuming the phone gets identified as a phone by LLDP):

auto-sense voice i-sid 10100 c-vid 100

If using RADIUS authentication, the RADIUS reply should just be an accept in this case, and the phone should end up in the voice VLAN tagged. If you don't want to RADIUS-authenticate the phone, you can bypass RADIUS for phones using "auto-sense eapol voice lldp-auth".

Link to section in the user guide: Fabric Engine v9.3 User Guide 

For the client device connected behind the phone, you can either:

• Configure a data-vlan for auto-sense using "auto-sense data i-sid 100200". In this case the switch will place the client device on the data-vlan after it gets a RADIUS accept, unless a specific VLAN is returned by the RADIUS server.
• Leave data-vlan unconfigured and have the RADIUS server return the VLAN attributes.

[Thomas_Gfeller]

Hi Olini

Thanks for reply, does both VOIP and Client using the same VLAN/ I-SID ID? are they both untagged? 

Thanks

Thomas 

[Olini · Accepted solution]

Hi Thomas,

in our case its different VLANs/I-SIDs, on the same port (transparent to the devices). Here is the documentation for this: https://documentation.extremenetworks.com/VOSS/SW/90/VOSSUserGuide/GUID-385E2C11-3642-494E-8A17-1273...

Kind regards

Oli