Fabric Engine NAC Voice VLAN tagged and daisy channed client

[Thomas_Gfeller]

Hi

I need to configure the Fabric Engine Access Port and Control Policy Mapping for VOIP devices. The port should be tagged in the voice vlan and also the switch should tell the VOIP device about the tag by LLDP MED. Behind the VOIP device we need to connect end device which should be put in untagged vlan.

My switch/ radius config looks like this:

radius server host x.x.x.x key ****** used-by eapol priority 1
radius enable
radius accounting enable
radius dynamic-server client x.x.x.x secret ****** enable
radius reachability mode use-radius
auto-sense wait-interval 2
#
# EAP CONFIGURATION
#
eapol enable
#
# PORT CONFIGURATION
#
interface GigabitEthernet 1/2
auto-recover-port enable
spoof-detect enable
auto-sense enable
name "NAC"
no shutdown
slpp-guard enable
eapol multihost mac-max 8192
eapol multihost eap-mac-max 32

eapol multihost non-eap-mac-max 32

Thanks for any help or best preactice advise.

Thomas

[brattlund89 · Accepted solution]

If you configure auto-sense voice settings it will advertise the voice VLAN over LLDP-MED (assuming the phone gets identified as a phone by LLDP):

auto-sense voice i-sid 10100 c-vid 100

If using RADIUS authentication, the RADIUS reply should just be an accept in this case, and the phone should end up in the voice VLAN tagged. If you don't want to RADIUS-authenticate the phone, you can bypass RADIUS for phones using "auto-sense eapol voice lldp-auth".

Link to section in the user guide: Fabric Engine v9.3 User Guide 

For the client device connected behind the phone, you can either:

• Configure a data-vlan for auto-sense using "auto-sense data i-sid 100200". In this case the switch will place the client device on the data-vlan after it gets a RADIUS accept, unless a specific VLAN is returned by the RADIUS server.
• Leave data-vlan unconfigured and have the RADIUS server return the VLAN attributes.

[Thomas_Gfeller]

Hi

Thank you both, in my case i will use auto-sense, but also good to know there is another method 🙂

Br

Thomas

[Olini]

All fine. We have fairly high security standards and didn‘t want to trust in the lldp advertisements of an unauthorized device, thats all.

Br Oli

[brattlund89 · Accepted solution]

If you configure auto-sense voice settings it will advertise the voice VLAN over LLDP-MED (assuming the phone gets identified as a phone by LLDP):

auto-sense voice i-sid 10100 c-vid 100

If using RADIUS authentication, the RADIUS reply should just be an accept in this case, and the phone should end up in the voice VLAN tagged. If you don't want to RADIUS-authenticate the phone, you can bypass RADIUS for phones using "auto-sense eapol voice lldp-auth".

Link to section in the user guide: Fabric Engine v9.3 User Guide 

For the client device connected behind the phone, you can either:

• Configure a data-vlan for auto-sense using "auto-sense data i-sid 100200". In this case the switch will place the client device on the data-vlan after it gets a RADIUS accept, unless a specific VLAN is returned by the RADIUS server.
• Leave data-vlan unconfigured and have the RADIUS server return the VLAN attributes.

[Olini]

We use RADIUS attributes for this. When the VoIP phone authenticates, it receives its VLAN and I-SID using the Extreme-Dynamic-Client-Assignments RADIUS attribute VSA. The port is in MHMV mode, and the client behind the phone is authenticated separately and assigned using the same VSA (different VLAN and I-SID).