XOS - 802.1X AP but bypass bridge@AP clients

[Ronald_Dvorak]

Hi,

is it possible to authenticate the AP via 802.1X PEAP on the switchport but bypass/disable the authentication for the bridge@AP clients that are connected to the AP.

Could you please tell me the configuration steps on the XOS or other ideas for this scenario.

Thanks,
Ron

[Rainer_Adam]

Is there any comparable solution for EOS Switches?

[Patrick_Koppen]

yes. It's called 'ap-aware'. https://gtacknowledge.extremenetworks.com/articles/Q_A/What-does-this-Feature-AP-Aware-means-on-the-B5-C5-Securestack

[James_A]

A few years later, that KB links to this one which says AP Aware is supported since XOS 22.2 https://gtacknowledge.extremenetworks.com/articles/How_To/EMC-How-to-enable-the-AP-Aware-Feature-in-EMC-s-Policy-Manager

[Matthew_Helm1]

"Campus mode" vs. "ISP mode" has really to do with VLAN assignment mechanism for the port. In the former, VLAN assignment is done using a VSA sent by the RADIUS server for each authorized client. For ISP mode, the port is preconfigured into a VLAN (typically untagged, but not always) and any authorized clients are bridged into that VLAN.

MAC-based VLAN mode for Netlogin is necessarily "Campus mode" and has the disadvantage that all BUMs are received by all clients on that port regardless of their VLAN assignment.

Regardless, whether pre-configuring the netlogin enabled port into a VLAN, or using a VSA to assign the port to a VLAN, multiple supplicant is still in effect for that port.

However, pre-assigning the VLANs and not using the VSA for the dot1x authentication is a very good idea for my script above. I'll need to make further comments.