IAS dot1x dynamic VLAN assignment not working

I have a windows 2003 server with AD and IAS configured. IAS uses AD for authentication. I have AAA login configured and working. I have AAA dot1x configured on the 3550 switch. IAS has a Wired Ethernet policy configured for PEAM and is send back attributes tunnel-type = VLAN, tunnel-medium-type = 802, and tunnel-pvt-group-id = 210. My XP supplicant has dot1x enabled and is authenticating through the switch and IAS.
Using Ethereal I can see the both the Radius request and accept packets. I can see that radius is sending the above attributes through ethereal as well. Using the Debug Radius command I can see that the attributes are getting to the switch. When I use the show VLAN command the switch port is still in VLAN 1. I want it to be in VLAN 210.
I have upgraded the IOS in the 3550 switch. This fixed a previous problem of the switch not sending the NAS port type of Ethernet. It as sending a port type of Asynch.
I also have service pack 2 on the Windows 2003 server.
Has anyone else had this problem? If so how do I fix it.
Here is my debug code:
06:56:45: RADIUS: Tunnel-Medium-Type [65] 6 00:ALL_802 [6]
06:56:45: RADIUS: Tunnel-Private-Group[81] 5 "210"
06:56:45: RADIUS: Tunnel-Type [64] 6 00:VLAN [13]
Here is my switch code:
aaa new-model
aaa authentication login default group radius local
aaa authentication dot1x default group radius local
aaa session-id common
interface FastEthernet0/1
switchport mode access
dot1x pae authenticator
dot1x port-control auto
radius-server host 10.1.1.254 auth-port 1645 acct-port 1646 key test
radius-server deadtime 60

You're missing this:
aaa authorization network default group radius
I assume "everything works" other than VLAN-Assignment itself.
This should get you squared away,

Similar Messages

  • Cisco ACS4.1- Radius Dynamic VLAN assignment not working

    When the users connect their laptop they are getting a authentication prompt but the switch is not changing the VLANs on the port after successfull authentication.Below are the logs on the switch
    Jan 28 2013 17:21:32.417 CST: RADIUS:  Framed-MTU          [12]  6   1500
    Jan 28 2013 17:21:32.417 CST: RADIUS:  Called-Station-Id   [30]  19  "E4-D3-F1-0B-C6-0A"
    Jan 28 2013 17:21:32.417 CST: RADIUS:  Calling-Station-Id  [31]  19  "84-8F-69-A8-BD-1D"
    Jan 28 2013 17:21:32.417 CST: RADIUS:  EAP-Message         [79]  45
    Jan 28 2013 17:21:32.417 CST: RADIUS:   02 0E 00 2B 19 00 17 03 01 00 20 8A 07 E9 A6 A9 75 88 06 4A 8C 55 BE 3D EB 49 84 7B 0E 59 5D 3F 93 67 63 82 9C B4 AD 13 9F CA 67    [ + uJU=I{Y]?gcg]
    Jan 28 2013 17:21:32.417 CST: RADIUS:  Message-Authenticato[80]  18
    Jan 28 2013 17:21:32.417 CST: RADIUS:   09 58 21 FE E5 9F 46 44 64 F7 C3 B2 4B 9F C4 35           [ X!FDdK5]
    Jan 28 2013 17:21:32.417 CST: RADIUS:  EAP-Key-Name        [102] 2   *
    Jan 28 2013 17:21:32.417 CST: RADIUS:  Vendor, Cisco       [26]  49
    Jan 28 2013 17:21:32.417 CST: RADIUS:   Cisco AVpair       [1]   43  "audit-session-id=0A0065080000000E524420EE"
    Jan 28 2013 17:21:32.417 CST: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
    Jan 28 2013 17:21:32.417 CST: RADIUS:  NAS-Port            [5]   6   50010
    Jan 28 2013 17:21:32.417 CST: RADIUS:  NAS-Port-Id         [87]  21  "GigabitEthernet0/10"
    Jan 28 2013 17:21:32.417 CST: RADIUS:  State               [24]  25
    Jan 28 2013 17:21:32.417 CST: RADIUS:   45 41 50 3D 30 2E 32 30 30 2E 31 34 2E 33 3B 53  [EAP=0.200.14.3;S]
    Jan 28 2013 17:21:32.417 CST: RADIUS:   56 43 3D 30 2E 38 3B           [ VC=0.8;]
    Jan 28 2013 17:21:32.417 CST: RADIUS:  NAS-IP-Address      [4]   6   10.0.101.8
    Jan 28 2013 17:21:32.417 CST: RADIUS(00000031): Started 5 sec timeout
    Jan 28 2013 17:21:32.425 CST: RADIUS: Received from id 1645/84 10.0.0.20:1645, Access-Accept, len 212
    Jan 28 2013 17:21:32.425 CST: RADIUS:  authenticator C8 5B D6 8E B2 72 26 F1 - 1B 2D D0 8B 02 96 0D 27
    Jan 28 2013 17:21:32.425 CST: RADIUS:  Framed-IP-Address   [8]   6   255.255.255.255
    Jan 28 2013 17:21:32.425 CST: RADIUS:  EAP-Message         [79]  6
    Jan 28 2013 17:21:32.425 CST: RADIUS:   03 0E 00 04
    Jan 28 2013 17:21:32.425 CST: RADIUS:  Vendor, Microsoft   [26]  58
    Jan 28 2013 17:21:32.425 CST: RADIUS:   MS-MPPE-Send-Key   [16]  52  *
    Jan 28 2013 17:21:32.425 CST: RADIUS:  Vendor, Microsoft   [26]  58
    Jan 28 2013 17:21:32.425 CST: RADIUS:   MS-MPPE-Recv-Key   [17]  52  *
    Jan 28 2013 17:21:32.425 CST: RADIUS:  Tunnel-Type         [64]  6   01:VLAN                   [13]
    Jan 28 2013 17:21:32.434 CST: RADIUS:  Tunnel-Medium-Type  [65]  6   01:ALL_802                [6]
    Jan 28 2013 17:21:32.434 CST: RADIUS:  Tunnel-Private-Group[81]  6   01:"103"
    Jan 28 2013 17:21:32.434 CST: RADIUS:  Class               [25]  28
    Jan 28 2013 17:21:32.434 CST: RADIUS:   43 41 43 53 3A 30 2F 64 65 31 39 63 2F 61 30 30  [CACS:0/de19c/a00]
    Jan 28 2013 17:21:32.434 CST: RADIUS:   36 35 30 38 2F 35 30 30 31 30        [ 6508/50010]
    Jan 28 2013 17:21:32.434 CST: RADIUS:  Message-Authenticato[80]  18
    Jan 28 2013 17:21:32.434 CST: RADIUS:   C2 71 F0 8E 8D 10 8B 9F F1 8E 21 32 16 7D 7F D6              [ q!2}]
    Jan 28 2013 17:21:32.434 CST: RADIUS(00000031): Received from id 1645/84
    Jan 28 2013 17:21:32.434 CST: RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes
    Jan 28 2013 17:21:32.434 CST: %DOT1X-5-SUCCESS: Authentication successful for client (848f.69a8.bd1d) on Interface Gi0/10 AuditSessionID
    Jan 28 2013 17:21:32.434 CST: %AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (848f.69a8.bd1d) on Interface Gi0/10 AuditSessionID 0A0065080000000E524420EE
    Siddhartha       

    I should have done little more research before I post this question , found the issue, its the config on the switch.I missed the below line
    aaa authorization network default group radius
    thanks...
    Siddhartha

  • Dynamic vlan assignment with 1242AG and IAS not working

                       I'm having trouble getting the dynamic vlan assignment to work on my 1242AG Cisco Aironet APs. I've seen multiple cases with a similar setup and configuration where it works just fine.  I've tried everything I can think of.  Any suggestions?
    IAS and AD is running on Windows Server 2003
    Everything works fine except the vlan assignment.  Wireless clients successfully authenticate through IAS and Active Directory, but instead of being switched to the appropriate vlan the client stays in whichever vlan/ssid it originally connected to.
    PEAP is the authentication method, using MS-CHAP v2.  Naturally I have the attributes in the policy set appropriately, ie:
    Tunnel-Medium-Type > 802
    Tunnel-Pvt-Group-ID > vlanid
    Tunnel-Type > VLAN
    On the AP:
    Cisco 1242AG, C1240 Software (C1240-K9W7-M), Version 12.4(3g)JA, RELEASE SOFTWARE (fc2)
    I've attached the config for the AP, which shows that I have two vlans/SSIDs set to cipher, aes, network eap, wpa, etc. I noticed that if the
    Tunnel-Pvt-Group-ID attribute is set to a vlan id that doesn't exist on the AP then the AP makes an event log saying so.

    Good! Well to answer your questions, IAS is sending numbers, i.e. Tunnel-Pvt-Group-ID > 129
    I did view the debug from an AP which showed the Tunnel attributes being recieved from the radius server (I'll have to wait until Monday to get a copy though).
    I see I don't have that line "aaa authorization network default group rad_eap",
    So I'll have give it a try, (maybe I can remote in so I don't have to wait until Monday).
    Thanks,
    Jason

  • HREAP and Dynamic VLAN assignment (MS NPS)

    Hi All
    Just a quick rundown of what I am trying to achieve.
    We have a Cisco 5508 WLC (running AIR-CT5500-K9-7-0-116-0.aes). At the moment the WLC is controlling only 1 AP (Cisco 1142N LWAP). I want this AP to be placed at a remote site, and users that authenticate via the RADIUS (MS Windows 2008 NPS) server must be assigned their respective VLANs based on the Active Directory groups they belong to (staff, student, or guest).
    The AP and dynamic VLAN assignment works 100% if the AP is in local mode. Authentication works, and dynamic VLAN assignment works. As soon as you change the AP to HREAP mode, dynamic VLAN assignment stops working, and the client gets assigned an IP of whatever VLAN is assigned to the SSID under the HREAP tab. Allow AAA Override is enabled on the main SSID that I am broadcasting.
    I have read in some of the discussions that HREAP does not support dynamic VLAN assignment, but I haven't seen why this is not supported. Is this true with the latest version of WLC software as well? I cannot see why local traffic destined for a local resource must be sent via a WAN link to the controller, and then back over the WAN link again. This seems very inefficient.
    Is there anybody that can confirm if this is in fact an HREAP limitation, and why (if so) it is a limitation, please? Any info would be much appreciated.
    Regards
    Connie

    Do you perhaps know if there are plans for this limitation being addressed in the near future?
    We are looking to deploy wireless from end-to-end in all 6 of our sites, and you biggest competitor was penalized because they do not support this feature. It seems we're going to have to apply the same penalty in this respect to Cisco as well.
    Thanks for the feedback, though!
    Regards
    Connie

  • Dynamic vlan assignment does not work

    Hello,
    I have been trying to configure dynamic vlan assignment for the employee wlan. Trying to put the employee on vlan 20
    Here are the components used
    WLC: 2100 Software version: 7.0.240.0
    AP: 3502I    IOS version: 12.4  Mini IOS version: 7.0
    Radius server: tried mutiple radius servers (rsa radius , free radius)
    On the WLC:
    1. Created a AAA server.
    2. Along with management interface(vlan 10), configured dynamic interfaces (vlan 20, vlan 30)
    3. AP manager interface is on vlan 40
    4. Created WLAN assigned to management interface-- WPA2 (AES) , 802.1x
    5. on AAA servers tab - checked authentication servers and assigned the AAA server. authentication priority order is set to only radius
    Here, I have 2 options for radius overwrite.
    one on the AAA servers tab
    second on the Advanced tab
    I have selected both. or one at a time
    Ports between WLC and switch is a trunk
    On the AP:
    1. Local mode
    2. Port between AP and switch switchport access  - vlan 40
    On radius server:
    configured WLC's management interface as client
    and assigned the following attributes
    tunnel-type := vlan
    tunnel-medium-type = ieee-802
    tunnel-private-group-id = 20
    When i try to authenticate with an iphone it is successful. But it puts me on the same interface as management interface (vlan10). When i do the packet capture i do see the access-accept but i dont see the attributes.
    when i use a radius test utility against the radius server I do receive all the attributes.
    Im a newbie on this. Iam i missing something here? any help will be much appreciated.

    Kindly check the following link for reference.
    sample configuration link
    http://www.cisco.com/c/en/us/td/docs/wireless/controller/5700/software/release/3se/security/configuration_guide/b_sec_3se_5700_cg/b_sec_1501_3850_cg_chapter_01110.html
    http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-0/configuration/guide/c70/c70intf.html
    Trouble shooting link
    http://www.cisco.com/c/en/us/support/docs/security/secure-access-control-system/113485-acs5x-tshoot.html

  • Dynamic VLAN Assignment + NPS

    Hello,
    I'm planning a deployment with the following:
    5508 WLC running 7.0.222.0
    NCS 1.0.2.29
    50+ 3502i AP's
    Windows 2008 R2 running NPS
    EAP-TLS for authentication
    The end goal is to have a single SSID and utilize NPS to dynamically assign VLAN's depending on role/group.
    I've read several documents that use ACS to complete the dynamic VLAN assignment (inclduing http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml), however in this case ACS is not available.
    My question basically is; do I need ACS to apply the VSA for Cisco Airespace, or can this be done solely with the following IETF attributes using Microsoft NPS and AAA override on the WLC?
    [64] Tunnel-Type
    [65] Tunnel-Medium-Type
    [81] Tunnel-Pvt-Group-ID
    Any advice would be greatly appreicated!
    Thanks

    Thanks Steve for your quick response.
    I did everything as per your recommendation and it still doesnt work.
    Do you mind providing me a remote assistance, do you have Skype?
    Or your prefer that I provide you a set of logs, tell me which one and I will do so.
    SSID:TT
    @IP WLC: 172.20.252.70
    NPS: 172.20.1.16
    config rule NPS: service-Type: NAS Prompt
                             Tunnel-Type: VLAN
                             Tunnel-pvt-group-ID:10
                             Tunnel-Meduim-Type:802
    log WLC:
    *radiusTransportThread: Sep 19 12:32:47.841: ****Enter processIncomingMessages: response code=2
    *radiusTransportThread: Sep 19 12:32:47.841: ****Enter processRadiusResponse: response code=2
    *radiusTransportThread: Sep 19 12:32:47.841: 8c:70:5a:1c:8e:20 Access-Accept received from RADIUS server 172.20.1.16 for mobile 8c:70:5a:1c:8e:20 receiveId = 4
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.841: 8c:70:5a:1c:8e:20 Processing Access-Accept for mobile 8c:70:5a:1c:8e:20
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.842: 8c:70:5a:1c:8e:20 Applying new AAA override for station 8c:70:5a:1c:8e:20
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.842: 8c:70:5a:1c:8e:20 Override values for station 8c:70:5a:1c:8e:20
    source: 4, valid bits: 0x200
    qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.842: 8c:70:5a:1c:8e:20 Override values (cont..) dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1
    vlanIfName: 'dy-data-ksb1', aclName: ''
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.842: 8c:70:5a:1c:8e:20 Inserting new RADIUS override into chain for station 8c:70:5a:1c:8e:20
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.843: 8c:70:5a:1c:8e:20 Override values for station 8c:70:5a:1c:8e:20
    source: 4, valid bits: 0x200
    qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.843: 8c:70:5a:1c:8e:20 Override values (cont..) dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1
    vlanIfName: 'dy-data-ksb1', aclName: ''
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.843: 8c:70:5a:1c:8e:20 Applying override policy from source Override Summation:
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.843: 8c:70:5a:1c:8e:20 Override values for station 8c:70:5a:1c:8e:20
    source: 256, valid bits: 0x200
    qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.843: 8c:70:5a:1c:8e:20 Override values (cont..) dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1
    vlanIfName: 'dy-data-ksb1', aclName: ''
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.843: 8c:70:5a:1c:8e:20 Setting re-auth timeout to 1800 seconds, got from WLAN config.
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.844: 8c:70:5a:1c:8e:20 Station 8c:70:5a:1c:8e:20 setting dot1x reauth timeout = 1800
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.844: 8c:70:5a:1c:8e:20 Creating a PKC PMKID Cache entry for station 8c:70:5a:1c:8e:20 (RSN 2)
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.844: 8c:70:5a:1c:8e:20 Adding BSSID 00:1e:be:a7:bf:b6 to PMKID cache for station 8c:70:5a:1c:8e:20
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.844: New PMKID: (16)
    *Dot1x_NW_MsgTask_0: Sep 19 12:32:47.844:      [0000] 80 36

  • Cisco WLC5508 Dynamic VLAN assignment error

    Hi All,
    We have a HA (SSO) WLC controller pair in two DC's with the Management Interface managing the AP's. The AP's are located in the Campus LAN and the Campus and DC networks are seperated by a L3 boundary.
    The plan is for one of the WLAN's to provide Dynamic VLAN Assignment via radius as a test I wanted to use the existing Management interface to bind to the WLAN, but since working through the following Document ID: 71683 one thing I noticed whilst working through the the document states that "it is required that the VLAN-ID configured under the IETF 81 (Tunnel-Private-Group-ID) field of the RADIUS server exist on the WLC"
    If the above statement is true and we don't stretch VLAN's between the Campus LAN and the DC network due to the L3 boundary does this mean that Dynamic VLAN assignment won't be achievable?  When testing a client connection and debugging the result I receive the following:-
    *radiusTransportThread: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a [BE-resp] AAA response 'Success'
    *radiusTransportThread: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a [BE-resp] Returning AAA response
    *radiusTransportThread: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a AAA Message 'Success' received for mobile 10:40:f3:84:a2:2a
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a processing avps[0]: attribute 11, vendorId 0, valueLen 11
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a processing avps[1]: attribute 64, vendorId 0, valueLen 4
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a processing avps[2]: attribute 65, vendorId 0, valueLen 4
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a processing avps[3]: attribute 81, vendorId 0, valueLen 2
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a processing avps[4]: attribute 8, vendorId 0, valueLen 4
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a processing avps[5]: attribute 79, vendorId 0, valueLen 40
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a Received EAP Attribute (code=2, length=40,id=64) for mobile 10:40:f3:84:a2:2a
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 00000000: xxxxxx
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 00000010: xxxxxx
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 00000020: xxxxxx
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a processing avps[6]: attribute 1, vendorId 9, valueLen 16
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a processing avps[7]: attribute 25, vendorId 0, valueLen 25
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a processing avps[8]: attribute 80, vendorId 0, valueLen 16
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a AAA override: Dot1x Authentication PMIP Client AAA Override Enable
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a AAA override: Dot1x Authentication, default MPC configuration
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.115: [PA] 10:40:f3:84:a2:2a Tunnel-Type 16777229 should be 13 for STA 10:40:f3:84:a2:2a
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.116: [PA] 10:40:f3:84:a2:2a Tunnel-Group-Id 9 is not a valid VLAN ID for STA 10:40:f3:84:a2:2a
    *Dot1x_NW_MsgTask_2: Jan 15 13:26:23.116: [PA] 10:40:f3:84:a2:2a Received Session Key from AAA Server for STA 10:40:f3:84:a2:2a.
    I've sanitised some of the debug output to protect the username but the net result is no IP address assigned to the client and unable to connect to the network.
    Would appreciate any guidance as to whether the Wireless Client VLAN's need to be interfaces on the WLC in order to work or whether the likes of Flexconnect could alleviate the L3 boundary?
    Thanks in advance.
    Kind regards,
    Mark

    Hi All,
    After playing with Flexconnect I managed to get the dynamic vlan assignment working.
    Need to create the Flexconnect Group add in the AP's to the gorup and then select the ACL Mapping tab > AAA VLAN-ACL mapping and added in the VLAN of my VLAN that my Tunnel-Group-ID (VLAN ID) had assigned to me.
    Client connected and received the correct IP configuration.
    Thanks
    Mark

  • Dynamic Vlan Assignment

    All,
    I'm looking for a means to secure interfaces configured in an admin vlan.
    In an ideal world the interface would be configured with the admin vlan if the device is somehow identified (not necessarily authenticated). In the event that the device isn't identified it fails back to a standard device vlan.
    I've had a look at VMPS but understand that this is a dying feature and would be a poor idea to implement it. The alternative appears to be passing a vlan tag as a RADIUS attribute.
    I'd be keen to know if anybody can make any suggestions as to how I could implement this? Ideally it needs to be simple with fewer complexities to go wrong.
    To add to this, devices are hanging off of IP phones which aren't Cisco.
    Any help would be appreciated.
    Neil                  

    Hi Neil,
    To add to what Tarik said, I would also describe that can be used with whatever radius server you have.
    in ISE (Tarik, correct me if I am wrong) the devices and getting profiled automatically depending on many attributes and the device can be distinguished if it is an ip phone, laptop, ipad...etc. and based on that the VLAN assignmed is applied.
    With other radius servers you need to statically specify what VLANs should the users be put in. The VLAN assignment is being done based on username the user is using OR the mac address the device provides.
    Two weeks ago I implemented the same scenario using cisco ACS 5.3 radius server where users have multiple AD users and some other devices (ip phones, network printers...etc) and the VLAN assignment happens based on the AD group or the type of the device.
    I manually added the mac addresses of priners in a group, ip phones in different group..etc. and I configured the ACS to assign the VLAN based on that gorup. with ISE what I know is it detects the device type automatically (you have to configure a profile for device types though) and based on that it assigns a VLAN.
    You need to notice one thing though, if you are configuring the switch for the dot1x authentication you need to add a configuraiton in the radius in order to tell the switch to use teh VOICE vlan (not DATA vlan) for the phones. Otherwise the phone will use DATA VLAN when authenticated and not the voice VLAN which makes only one device; the phone or the PC attached to it, to work.
    If you use cisco switches, you need to return to cisco-av-pair attribute with value "device-traffic-class=voice" to the phones when they authenticate. I used this with non-cisco phones and it works like a charm.
    Let us know if there is anything else you need to know about dynamic vlan assignment.
    I hope that was useful to you.
    Amjad
    Rating useful replies is more useful than saying "Thank you"

  • Dynamic VLAN assignment on SG300

    Cisco documentation states that dynamic vlan assignment via RADIUS should provide the following IETF values:
    The RADIUS user attributes used for the VLAN ID assignment are:
    IETF 64 (Tunnel Type)—Set this to VLAN.
    IETF 65 (Tunnel Medium Type)—Set this to 802
    IETF 81 (Tunnel Private Group ID)—Set this to VLAN ID
    I have done so with an Aruba Clearpass RADIUS server - but the Access-Accept message being sent below:
    Radius:IETF:Tunnel-Medium-Type     6
    Radius:IETF:Tunnel-Private-Group-Id     4
    Radius:IETF:Tunnel-Type     13
    is being received by the SG300 in some way that's not being interpreted correctly. Log files indicate that the IETF values are not what is expected:
    07-Aug-2014 18:58:41 :%SEC-W-SUPPLICANTUNAUTHORIZED: username teststudent with MAC 00:11:25:d8:42:83 was rejected on port gi2 because Radius accept message does not contain VLAN ID
    07-Aug-2014 18:58:41 :%AAAEAP-W-RADIUSREPLY: Invalid attribute 65 ignored - tag should be 0
    07-Aug-2014 18:58:41 :%AAAEAP-W-RADIUSREPLY: Invalid attribute 64 ignored - tag should be 0
    Is there something I'm missing here? These same values sent by the Clearpass RADIUS server are working for other switches such as Extreme and Brocade.
    Thanks,
    Aaron

    Hi Aleksandra,
    Here are the values from a packet capture of the Access-Accept message:

  • WLC- dynamic Vlan assignment with Radius

    Hello, we would like to use this feature in our company and because of that I am now testing it. But I found one problem.
    I created one testing SSID and two Vlans on WLC. On ACS I use an IETF atributes (064,065,081) for my account and I am changing Vlan ID (081) during testing.
    It works with LEAP but when I use PEAP-GTC (which we use commonly in our company) the ip address is not assigned properly (ip which was assigned before remains).
    Could you please help me?

    There is good document which explains how to configure Dynamic VLAN Assignment with RADIUS Server and Wireless LAN Controller. This will help you. You will find the document at http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml

  • Flexconnect dynamic VLAN assignment doubt

    Hi, all,
    I am trying to understand how FlexConnect with dynamic VLAN assignment works. We have the need to dynamically put people in different VLANs based on their AD groups (all employees use the same SSID), I can understand that in traditional CAPWAP mode, AP just tunnels all traffic to WLC, WLC is the authenticator and it knows  what users' identities are and can encapsulate user traffic to different VLANs before send the traffic to the switch it connects. Here is the part I don't understand:
    1) If APs are operating in Flexconnect mode (APs are trunking to switches), how does each AP know what VLAN tag to put a specific user traffic on? AP is not authenticator, it knows nothing about associated client's AD identify. How does WLC convey the dynamical VLAN information to APs?
    2) I want to eliminate WLCs in remote offices by letting all remote office APs join HQ WLC with FlexConnect mode, I can keep the same VLAN mapping scheme in remote office switching environment, in some offices I want to do local authentication (Domain controller + Radius Server), looks like I can specify Radius server in FlexConnect group, in this case will APs become authenticator? Since Radius clients have to be explicitly configured on NPS/Radius server side, does this means I have to statically configure each AP's IP?
    3) I have over a dozen APs in HQ which are operating at FlexConnect mode, but the SSID's "local central authentication" checkbox is not checked, if I want to have local authentication in remote office,  seems that I have to turn on "local authentication" on this SSID, does that mean I have to add each and everyone of those HQ APs to Radius/NPS server client list?
    Thanks,

    Hi ,
    1) Aps knows about Vlans as we can define them inside the Flex connect groups. This is the same way we define flex connect ACLs which are pushed to the Flex APs and are returned by the Radius server later on.
    2) If you are going for Central authentication + local switching ....WLCs will always act like central authenticator and would talk to the radius server. If you have some radius servers at the local site and you want them to use without going through the central authentication..you can do that using (local authentication + local switching). Yes, In this case AP will be authenticator and would be AAA client to be added in the Radius server.
    3)yes ,,you are correct. If you want that your AP should do authentication and talk to the local radius server at the site , it has to be added in the Radius server.
    Regards
    Dhiresh
    **Please rate helpful posts**

  • 802.1x authetication with dynamic Vlan assignment by a radius server

    Hi
    At school I want to start using 802.1x authentication with dynamic Vlan assignment by a Windows Server 2012R2 Radius server.
    When a student logs in, I want it to be placed in the "Students" Vlan, when a Administrative employee logs in, I want it to be placed in the "Administative" vlan and when the client is unknown I want to place it in the "Guest" Vlan.
    I have several SG200 switches and I configured everything as mentioned in the administrative guide but I cannot get it to work as desired.
    What does work:
    - If the client is permitted, the switch changes to "authorized" state. (before anyone logs on to the domain with that client)
    - When a User logs on that is part of the Administrative employees, the switch changes to "authorized" and when a student logs on, it changes to "unauthorized". 
    So far so good.
    But what doesn't work:
    - it does not put the administrative employee in the Vlan "Administrative", it just enables the port on the switch but leaves it in the default vlan 1.
    - I can not find the Guest VLAN.
    Any help would be appriciated.

    Hi Wouter,
    Can you see in the packet capture Radius accept message VLAN attribute? Also please ensure you have the latest firmware and boot code:
    http://www.cisco.com/c/en/us/support/switches/sg200-26-26-port-gigabit-smart-switch/model.html#~rdtab1
    I would recommend you to open ticket with Small Business team so they can go with you through packet capture and configuration steps:
    http://www.cisco.com/c/en/us/support/web/tsd-cisco-small-business-support-center-contacts.html
    Regards,
    Aleksandra 

  • 802.1x dynamic VLAN assignment with Radius NPS Server

    I can NOT get the NPS and Cisco 3550 switch to drop the authenticated user in a VLAN.
    I have followed this documentation,
    http://msdn.microsoft.com/en-us/library/dd314181(v=ws.10).aspx
    that basically says to use these Radius attributes,
    Tunnel-Medium-Type : 802
    Tunnel-Pvt-Group-ID  :  My_VLAN_Number  (also tried VLAN name)
    Tunnel-Type  : VLAN
    There is some Cisco documentation that says to use Vendor Specific attributes Cisco-AV-Pair,
    http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_19_ea1/configuration/guide/2950scg/swauthen.html#wpxref83693
    and I have also tried that,
    cisco-avpair= "tunnel-type(#64)=VLAN(13)"
    cisco-avpair= "tunnel-medium-type(#65)=802 media(6)"
    cisco-avpair= "tunnel-private-group-ID(#81)=vlanid"
    My user authenticates on the port fine, but doesn't get put into a VLAN.  If I add "sw acc vlan 110"  then the user authenticates and then does get an IP address in that VLAN and all is well.
    Anybody know how to get dynamic VLAN assignment working with NPS?
    NPS on Win 2012 R2
    Domain controller separate Win 2012 R2 server
    Cisco 3550 switch

    Hi All, Can any one guide me to
    configure 802.1x with acs 5.0. Its totally new look and m not able to
    find document related to 802.1x.Thanks
    Hi,
    Check out the below link on how to configure 802.1x and ACS administration hope to help !!
    http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a00808abf2d.shtml#MDA
    Ganesh.H

  • 802.1x dynamic vlan assignment using ACS 4.2

    Hi
    we have 10 switches 2960 configured with 802.1x authentication against ACS server 4.2.
    we have 2 vlans configured on the switches for administrator and endusers. the end user vlan id is 10 and the administartor vlan is is 100.
    we need to apply the following scenario, if the enduser PC - that is connected to vlan 10 - has an issue and the administrator will login to the PC with the administrator account to fix that issue, the switch should dynamically reconfigure the port with the administrator vlan ( 100 ) .
    is the above scenario doable using dot1x with the ACS server?
    waiting your replies
    Mohamed

    Hi,
    I have the following scenario
    2 bulidings with multiple floor
    Each floor should be in different VLAN.
    The network should be authenticated with 802.1x and each switch port should be assigned with dynamic VLAN from ACS.
    Each
    user should be able to connect and roam around between any building.
    when ever a user is connecting his laptop to any floor, he should be
    made part of that respective vlan. It is not requred to have the same
    IP rage to be allocated, but the dynamic VLAN should be based on the
    switch port location.
    Can
    I configure ACS in such a way that, the ACS will allocate dynamic VLAN
    for every 802.1x authentication  based on the Network Device Group.
    Please refer the attached diagram
    Hi,
    Check out the below link for your requirement for dynamic vlan assignement using ACS
    http://www.ciscosystems.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml
    Hope to Help !!
    Ganesh.H
    Remember to rate the helpful post

  • Cisco av-pairs SSID vs Dynamic Vlan Assignment

    Hello,
    Once upon a time, there was a Cisco av-pairs attribute to allow a Wireless user to a given SSID through Radius servers.
    If I'm not wrong, this feature has not been supported anymore (for several years) on WLC.
    Dynamic vlan assignment is an alternative way to control user acces to a given vlan. It simplifies the architecture, because only one SSID is needed and the user traffic is then redirected to the right vlan. But... There is an important issue with it, since only one SSID (and BSSID) is used, broadcast packets from all vlans are transmitted to everybody. It is an issue when some services use broadcast to announce their features (IPv6 autoconf, Bonjour, and so on...).
    So the question is if a working alternative to SSID av-pairs exists.
    Thanks.     

    To be honest, I have never heard of this SSID av-pair ever working in wireless:)
    You would need at least two ssids and the radius server would need to ability to send a CoA to dissassociate the device so that the device would join the other SSID. The radius server would also have to push out the wireless profile to the client for the SSID they need to associate to. This can be done using Cisco ISE, but not Microsoft radius or even Cisco ACS.  
    You can still use aaa overuse to place devices on specific vlans and use the WLC to allow bonjour or  ACLs to filter what you don't want going out of the vlan.  WLC has bonjour capabilities and thus you can specify that on the interface and not on the WLAN.  If course their are limitations, but with newer requirements means that there is no one answer.  You might be able to meet certain requirements, but other you will have to sort of figure out.  
    -Scott

Maybe you are looking for