Yet another IAS + 802.1x dynamic vlan question

hello all
For the last 18 months or so there's been a steady stream of folks trying to get dynamic assignment of a vlan to a user/group using Microsofts IAS Radius.
Having searched thru the Netpro archives, I've never found a definitive explaination of how this is done.
Sure, its almost common knowledge by now that the three attributes 64(Tunnel-Type=vlan), 65(Tunnel-Medium=802) and 81(Tunnel-Private-Group-ID=vlan name) need to be configured on the Radius Server.
Recently I discovered that IAS on windows 2003 even includes the Radius "tunnel-tag" attribute, so even that can be included now(as =1).
Still, having done this, and seeing a "debug radius" on a 2950 switch (with newest code) show the the tunnel-tag starts with "01" --- i STIll can't get this darn thing to work.
Yes, it works for static 802.1x(no vlan assignment) against a XP sp2 client .
Yes, I included the "aaa authorization network default group radius" statement.
If I configure a vlan 5 named "Sales" --- nothing works. Not when I configure attribute 81=Sales in IAS, not when I configure "5" in IAS. Heck, I even used hex values--- till I got
" Attribute 81 6 01000005 " in the debug,
all sorts of permutations.
Please Cisco, somebody --- help us out here.
The fact of the matter is, though ACS is probably the best way to go(it does NAC & FAST), alot of clients say "hey - I've got a perfectly good Radius Server for FREE in Windows".
Can anybody shed some light on this!

Here is working IAS settings and switch config:
Ignore-User-Dialin-Properties 4101 True
Framed-Protocol 7 PPP
Service-Type 6 Framed
Tunnel-Medium-Type 65 802
Tunnel-Pvt-Group-ID 81 102
Tunnel-Type 64 VLAN
Tunnel-Tag 4170 1
*Note that I have VLAN#, not VLAN name on attribute 81
aaa new-model
aaa authentication dot1x default group radius none
aaa authorization network default group radius none
aaa accounting dot1x default start-stop group radius
dot1x system-auth-control
interface FastEthernet0/1
switchport access vlan 100
switchport mode access
dot1x port-control auto
dot1x timeout reauth-period 300
dot1x guest-vlan 997
dot1x reauthentication
spanning-tree portfast

Similar Messages

802.1x Dynamic VLAN Switching Question

Trying to set up 802.1x dynamic VLAN switching, and have a question. I think I've gotten it working except for one part. The VLAN on a protected interface is never getting switched. I can see an entry in the ACS stating that it applied the appropriate VLAN via RADIUS response, but it never changes on the switch.
Environment:
ACS Express 5.0.1
C3550 running c3550-ipbasek9-mz.122-44.SE6.bin
Switch config:
aaa new-model
aaa group server radius dot1x
server-private 10.10.1.4 auth-port 1645 acct-port 1646 key 7 071C244F5C0C0D544541
aaa authentication dot1x default group dot1x
dot1x system-auth-control
dot1x guest-vlan supplicant
interface FastEthernet0/3
switchport access vlan 3
switchport mode access
speed 100
duplex full
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout tx-period 5
dot1x timeout supp-timeout 5
spanning-tree portfast
ip radius source-interface FastEthernet0/1 vrf default!
radius-server host 10.10.1.4 auth-port 1645 acct-port 1646 key 7 01000307490E125E731F
Am I missing something easy?

It looks like "aaa authorization network default group dot1x" was the missing command I needed to get this working.
The only issue I'm having now is that if the client fails to meet the authentication requirements, the line status gets set as "down"

802.1x dynamic VLAN assignment with Radius NPS Server

I can NOT get the NPS and Cisco 3550 switch to drop the authenticated user in a VLAN.
I have followed this documentation,
http://msdn.microsoft.com/en-us/library/dd314181(v=ws.10).aspx
that basically says to use these Radius attributes,
Tunnel-Medium-Type : 802
Tunnel-Pvt-Group-ID : My_VLAN_Number (also tried VLAN name)
Tunnel-Type : VLAN
There is some Cisco documentation that says to use Vendor Specific attributes Cisco-AV-Pair,
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_19_ea1/configuration/guide/2950scg/swauthen.html#wpxref83693
and I have also tried that,
cisco-avpair= "tunnel-type(#64)=VLAN(13)"
cisco-avpair= "tunnel-medium-type(#65)=802 media(6)"
cisco-avpair= "tunnel-private-group-ID(#81)=vlanid"
My user authenticates on the port fine, but doesn't get put into a VLAN. If I add "sw acc vlan 110" then the user authenticates and then does get an IP address in that VLAN and all is well.
Anybody know how to get dynamic VLAN assignment working with NPS?
NPS on Win 2012 R2
Domain controller separate Win 2012 R2 server
Cisco 3550 switch

Hi All, Can any one guide me to
configure 802.1x with acs 5.0. Its totally new look and m not able to
find document related to 802.1x.Thanks
Hi,
Check out the below link on how to configure 802.1x and ACS administration hope to help !!
http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a00808abf2d.shtml#MDA
Ganesh.H

802.1x dynamic vlan assignment using ACS 4.2

Hi
we have 10 switches 2960 configured with 802.1x authentication against ACS server 4.2.
we have 2 vlans configured on the switches for administrator and endusers. the end user vlan id is 10 and the administartor vlan is is 100.
we need to apply the following scenario, if the enduser PC - that is connected to vlan 10 - has an issue and the administrator will login to the PC with the administrator account to fix that issue, the switch should dynamically reconfigure the port with the administrator vlan ( 100 ) .
is the above scenario doable using dot1x with the ACS server?
waiting your replies
Mohamed

Hi,
I have the following scenario
2 bulidings with multiple floor
Each floor should be in different VLAN.
The network should be authenticated with 802.1x and each switch port should be assigned with dynamic VLAN from ACS.
Each
user should be able to connect and roam around between any building.
when ever a user is connecting his laptop to any floor, he should be
made part of that respective vlan. It is not requred to have the same
IP rage to be allocated, but the dynamic VLAN should be based on the
switch port location.
Can
I configure ACS in such a way that, the ACS will allocate dynamic VLAN
for every 802.1x authentication based on the Network Device Group.
Please refer the attached diagram
Hi,
Check out the below link for your requirement for dynamic vlan assignement using ACS
http://www.ciscosystems.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml
Hope to Help !!
Ganesh.H
Remember to rate the helpful post

802.1x Dynamic Vlan assignment using ACS

Hi,
I have the following scenario
2 bulidings with multiple floor
Each floor should be in different VLAN.
The network should be authenticated with 802.1x and each switch port should be assigned with dynamic VLAN from ACS.
Each user should be able to connect and roam around between any building. when ever a user is connecting his laptop to any floor, he should be made part of that respective vlan. It is not requred to have the same IP rage to be allocated, but the dynamic VLAN should be based on the switch port location.
Can I configure ACS in such a way that, the ACS will allocate dynamic VLAN for every 802.1x authentication based on the Network Device Group. Please refer the attached diagram

Hi,
I have the following scenario
2 bulidings with multiple floor
Each floor should be in different VLAN.
The network should be authenticated with 802.1x and each switch port should be assigned with dynamic VLAN from ACS.
Each
user should be able to connect and roam around between any building.
when ever a user is connecting his laptop to any floor, he should be
made part of that respective vlan. It is not requred to have the same
IP rage to be allocated, but the dynamic VLAN should be based on the
switch port location.
Can
I configure ACS in such a way that, the ACS will allocate dynamic VLAN
for every 802.1x authentication based on the Network Device Group.
Please refer the attached diagram
Hi,
Check out the below link for your requirement for dynamic vlan assignement using ACS
http://www.ciscosystems.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml
Hope to Help !!
Ganesh.H
Remember to rate the helpful post

802.1x Dynamic VLans

I'm trying to figure out a way to get to 802.1x and Dynamic Vlans.
I have all types of devices, some login into windows AD some don't.
Is this possilbe?
port is setup to use 802.1x. Radius server first checks against AD, then checks for MAC address, if no conditions are met ports is set to a catch all type VLAN and starts forwarding.
Something like:
1. A Domain user/PC connects, user login to AD and assigned to a user VLan.
2. A printer is connected and assigned to a printer VLan.
3. A guest connects and is assigned to a guest VLan.
I like to not have to put MAC addresses in for PCs that are members of the the windows domain.

Hi
Please find the answers inline:
1. A Domain user/PC connects, user login to AD and assigned to a user VLan.
This is possible by using RADIUS extended attributes, to assign VLAN dynamically.. for this to work ,you need to define the radius server host & key on the switch/NAD. then enable dot1x on the switchport, to force authentication through RADIUS.. you can have a NAC client to key-in your AD username/password.. You would need to configure your RADIUS server to send vendor-specific attributes:
–[64] Tunnel-Type = VLAN
–[65] Tunnel-Medium-Type = 802
–[81] Tunnel-Private-Group-ID = VLAN name or VLAN ID
refer to CCO for more info on how the ACS server is configured for sending this info... apart from this on the switch configure "radius-server host x.x.x.x auth-port 1612 key *****" and the appropriate aaa commands to force dot1x to refer to RADIUS "aaa authentication dot1x default radius"
2. A printer is connected and assigned to a printer VLan.
For printers, or any non-dot1x compliant device, its general to use MAC authentication Bypass feature.. by doing this we can make sure the ports connecting to printers use the default "Switchport access vlan " configuration on these ports.. with MAB, we add the MAC address of the printer on the ACS server (with pw as mac-address) and make sure the printer is authenticated via the switch.. if you dont want to use MAC address for bypassing dot1x, you can probably disable dot1x on such ports.. similar methodology can be adopted for Servers, which wouldnt need dot1x.. since there are few printers & servers on networks, you can disable dot1x on these ports...
3. A guest connects and is assigned to a guest VLan.
This is achieved by using the guest-vlan feature.. guests who dont have dot1x client, will be put on a seperate isolated VLAN called guest vlan.. you can create a vlan say vlan 99 on the switch for guests, and on the switchport configure "dot1x guest-vlan 99" .. this would make sure the guests are seperated and isolated.. make sure you have vlan ACLs on VLAN 99 to restrict traffic for guest users only to internet, or place them behind DMZ of firewalls... you also have "authentication failure" VLAN which you can enable for production users when they fail authentication...
Refer to this Guide.. it has all information about 802.1x on switches...
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_50_se/configuration/guide/sw8021x.html#wp1270660
Hope this helps.. all the best..
Raj

Wlc2112-k9 802.1x dynamic vlans on multiple ports

I have a wlc2112-k9. I have succesfully setup a WLAN with 802.1x authentication and dynamic VLAN assignment. The issue I have (and maybe it isn't an issue and just the way the controller works) is that if the vlan interfaces I have defined are connected to different ports from which the default interface for the WLAN it doesn't work.
So for instance, I create my WLAN and set the interface to the management interface (which is connected to port 1). I then define all my other vlan interfaces that could be returned by my radius server.
     ex: vlan_102 connected to port 2
           vlan_104 connected to port 3
           vlan_106 connected to port 4
And so forth.
Port 1 is configured on the switch on vlan 21. If the radius server returns a VLAN ID of 102, 104 or 106 my client successfully connects to the WLAN but it gets put on VLAN 21. However if I move the vlan interfaces above over to port 1 the client correctly gets put on the correct VLAN.
All ports on the switch are configured as trunk with the native vlan set to the corresponding value that is set on the WLC.
Is this just the way the controller functions? That it can't assign a client to a different interface that is connected to a different port from the default one setup when the WLAN is created? I would have just though that if the radius server returned VLAN 102 that it would find that interface and connect the user session via that interface regardless of the port it is configured on.
Thanks

dynamic vlan assignment should work with the controller
by returing the standard IETF attributes
64,65, and 81
You said that you have configured the native vlan on each trunk port to be exactly the same as the vlan assigned to dynamic interface on the neighbor controller port. Make sure to have the native vlan something else specially i guess that you have tagged the vlans on those dynamic interfaces.
Please make sure to rate correct answers

802.1x dynamic vlan assignment based on MAC?

Hello,
I am using Catalyst3750 and Widows AD Authentication.
Our customers' pc is runnnig Windows (isn't 802.1x capable) that is connected to the catalyst switch.
Is it possible to dynamic assign a Vlan based on MAC?
When possible, we want to make it without using VMPS.
and, is there any document relating to the above.
Thanks a lot for you help.
Tomoyuki

Hello Tomoyuki,
which Radius Server are you using to authenticate your Clients?
For the Secure ACS you can configure a feature called "MAC-Authentication-Bypass" which fullfils your requirements.
This Feature must be configured on the Switch and on the Radius Server (which does the vlan assigment based on the MAC-Address of the Client)
An Overwiew of this feature can be found here:
http://www.cisco.com/univercd/cc/td/doc/solution/macauthb.pdf
I hope this helps,
Kind regards,
Chris

Yet another LE 8/LP 8 comparison questions

Good morning !
When I learned about Logic 8 this morning, I've browsed all the posts in this forum to learn about what differs between LE 8 and Logic Studio, to see which one best suits my needs. I still didn't see a clear answer to my interrogation, even though some topics were marked as "solved".
Here's what I found so far that comes only with Studio :
- Surround sound, distributed audio, high-end control surface support and TDM support.
- All the Jam packs.
- All the printed manuals.
So here are my questions:
- It says on the product page that Express got new Pro instruments like Ultrabeat, but what about the Vintage instruments (EVP88, EVB3 and EVD6) ? It seems only Studio got them, am I right ?
- I'm also guessing that Express doesn't get Mainstage ?
- Express now comes with the complete EXS sampler, but does it gets the "Studio Sound Library" with it's 1300 EXS instruments or just a few presets ?
My main motivation to go "Studio" is the sounds. I don't care about surround sound creations of complex stuff like that. People are stating that Studio got the jampacks so that alone is worth getting the Studio package, but IMO, all the studio instruments and the sound library are worth even more than the jampacks, and would be the real deal-breaker for me if they were only available in Studio.
Sorry for the long post, thanks for your input !

You are right about the Vintage Instruments, they're Studio-only. Main Stage is Studio-only as well. I don't think Express comes with the whole EXS Library but I'm not sure. As far as the JamPacks, remember those include not only loops but new presets and EXS instruments as well. And talking about sounds, Express won't give you Sculpture which is a **** of a synth.

802.1x dynamic vlan assignment with acs5.0

Hi All, Can any one guide me to configure 802.1x with acs 5.0. Its totally new look and m not able to find document related to 802.1x.
Thanks

Hi All, Can any one guide me to
configure 802.1x with acs 5.0. Its totally new look and m not able to
find document related to 802.1x.Thanks
Hi,
Check out the below link on how to configure 802.1x and ACS administration hope to help !!
http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a00808abf2d.shtml#MDA
Ganesh.H

Yet another "MacBook Air vs. Pro" question, now with specifics!

I'm upgrading from an older Mac Mini 2GB purchased in '08. I've looked at some recent comparicson threads here, but help me clarify my thinking for my specific situation...
I'm strongly considering the 13" MacBook Air. Aside from Web surfing and email, the most demanding regular use I foresee is photo editing in Aperture and maybe Adobe Lightroom. I'm not a pro, just a fairly avid amateur. I use iWork for home word processing, editing a club newsletter, etc. For photo editing I have a new non-Apple 24" monitor with DVI input. Hence, I probably will not need the sexy Retina display, tempting as it is.
Beyond that, I may download and demo industry specific software, both Windows and Mac versions, to practice and learn for my job. Adobe Captivate is on my list right now. I see in another thread that dual booting Windows in BootCamp is doable and works well.
I'll also occasionally use the Adobe CS suite (CS4 for now) for web design - no application development.
I also like to keep my computers as long as possible to amortize the cost. 4 years for my old Mini is actually pretty short. I had my old G3 tower for nearly 10 years! So I wonder if the limited upgradeability of the Air would be much an issue.

Your last sentence probably makes the MBA unsuitable for your consideration because the RAM is not upgradeable and the SSD uses a proprietary connector which limits your choices should you want to upgrade it (and increases the cost). The MBP offers the same portability with better graphics performance (it has a discrete video card rather than Intel integrated video), and its RAM and drive can be upgraded.
I have an early 2009 MBA which I've upgraded to 8GB and added an SSD to. Except for when I'm traveling, it is my professional workhorse and I can easily believe I'll get at least another 2 years of use from it. Because the MBA cannot be upgraded like the MBP can, I'm completely unwilling to estimate how long I might keep one. OTOH, I tend to resell my notebooks after 2 years and get a very good resale value from them.

Yet another iCloud with multiple Apple IDs question

I have a Mac, iPhone 3G, and an iPad 2. My wife has an iPod. I have historically synced via the desktop, and my music, calendar, contacts, etc. have shared just fine. I have a Mobile Me account which may or may not be doing anything for me. I understand it's going away anyhow.
Two of my devices share the same Apple ID, and one has a different ID. I don't know what my wife's iPod has for an Apple ID. One of the Apple IDs is a @me.com address.
I have set things up for iCloud, trying to have my calendar, photos, etc. come alive at once like they do in the commercials. After hours reading others' frustrations on here, I still am unsure how to proceed.
I can't change my @me.com AppleID because that is apparently against the rules. I can't add my other email address as a secondary address, because I am informed that that address is already verified as being in use (of course it is, by me). It won't let me change my other Apple ID to an @me.com address because that is also apparently against the rules.
Is there ANY solution that let's me keep syncing my music, plus let's me sync my calendar, contacts, photos, etc. in the Cloud? I don't want to lose any of my current information.

Thanks for the quick reply. I don't think it helps me.
My Mac and iphone have the same Apple ID. I innocently created a different AppleID when I bought my iPad. ([email protected]). I want them to sync automatically. They don't because they have different "clouds."
I don't want to have to log in to sync everything. If that were the case, I would just go on syncing every night via the Mac. Is there a way to get to where my iPad syncs with the other two?
Am I missing something simple here?

Yet another, tho slightly different tv out question

Hey all, good forum.
Got a MSI Ti200 ((MS8851) and want to use the tv out. It has the 4 pin SVHS output, going into a SVHS to RCA cable, then into scart socket.
Only problem is, whenever I try to select tv out on the display settings, the computer hard locks. (driver 45.something) I have to check the box in case the tv is not detected to be able to select tv out at all.
On earlier driver versions it does not detect the tv at all.
If I boot up with just the tv connected, the pre windows DOS display is fine on the TV, and is fine in windows ONLY IN SAFE MODE. If I install any drivers, as it boots into windows the display turns to trash. So it seems to me must be a software problem.
Things I have tried:
- TV on and on correct input before turning computer on
- fresh installs of both win98 and XP with only display drivers installed.
- made sure is set to 640*480 at minimum refresh, no progs to force refresh like Powerstrip etc
- made sure set to PAL-I (UK) - my TV (both of them) are fine with this as it works great with my -cough- ATI card.
- tried driver versions 30.82 thro to latest 52.something on both 98 and XP
Thanks a lot for any help
Jon
- tried all scart inputs on my video and TV.

I'm inclined to agree it's the cable. If it was just having issues with your device, that could mean a setting on your iPad was incorrect. But if multiple devices have issues, it's time to try a new cable.
~Lyssa

SG200-26: dynamic VLAN - 802.1X

Last week I got my SG200-26 (SLM2024T-EU). The Data Sheet says, that the switch works with dynamic VLAN assignment over 802.1X.
IEEE 802.1X
(Authenticator role)
802.1X: RADIUS authentication and accounting, MD5 hash
Supports time-based 802.1X
Dynamic VLAN assignment
The authentication on freeRADIUS works. I client could get access to the network after entering username and password but the client is not assigned to a VLAN. I used wireshark to sniff the authorisation process between the switch and the freeRADIUS server and the VLAN information were transmitted to the switch.
I would appreciate if some could give me some help how to configure the switch to work with dynamic VLAN assignment and freeRADIUS. If you need some more information, please let me know. I will add them here as far as possible.
Thank you very much!
Alexander
Edit

Hello Nico,
Thank you for your reply.
I will show you my scenario a little more in detail and explain, what I have configured:
I have got one server/router with a VLAN capable NIC connected to Port g1 on the switch. On the router I created 2 VLANs with VLAN-ID 5 and VLAN-ID 6.
Both VLAN "NICs" have a static IP address and there is running a DHCP server for each VLAN. On the same server there is runninga freeRADIUS server.
Now I did the following configuration on the switch:
1. I assigned a static IP on the switch.
2. SECURITY -> RADIUS:
I added the RADIUS Server IP address and the key string (same on switch and freeRADIUS) and I ticked Usage-Type: 802.1X
3. SECURITY -> 802.1X -> Properties
Port-Based Authentication: Enabled is ticked
RADIUS
4. SECURITY -> 802.1X -> Port Authentication
Administrative Port Control: Auto is ticked
5. VLAN-Management --> Create VLAN
VLAN-ID 5
Descr. VLAN5
VLAN-ID 6
Descr. VLAN6
I think, to this point the configuration is correct, isn't it ?
I would appreciate very much, if you could give me advice for the further steps like Port Mode Access, Trunk or General for the clients which connect to the switch and if tagged or untagged.
I have port g1 in trunk mode and VLAN5 and VLAN6 is tagged because my NIC is VLAN capable. But the other clients which connect to the switch do not have a VLAN capable NIC and these clients should get their VLAN assigned dynamically.
I attached the pcap file which contains the authentication between freeRADIUS and the SG200-26 (Port g1)
Thank you very much in advance!
Alexander

Cisco 2960 / Linksys SRW2008P - Radius dynamic vlan authentication

Hi all,
I am planning on purchasing a Linksys SRW2008P before I buy it I want to know if it has these features.
This is how my test lab is setup.
Laptop -> Linksys SRW2008 -> Cisco 2960 -> Linksys WRVS4400N -> Internet
My Cisco 2960 is going act as the "Distribution Switch" in my Lab. It's main purpose is to implment Radius 802.1X dynamic VLAN(s)
The Linksys WRV2008 will act as an "Access Switch" the main features I would like to know is if it can support 802.1X dynamic VLAN(s) propagated from the Linksys 2960.
For exmple: I am going to setup all my VLAN's on the 2960 and I want them to replicate to my SRW 2008 (like VTP). Whoever plugs into a port on the SRW will be authenticated via RADIUS and RADIUS will authenticate the port and send the VLAN information.
I searched throughout the forms and from what I see is that Linksys switches do not support Dynamic VLAN(s) but I want to double check
The reason why I am doing this is because I want 802.1X authentication throughout my small office but the problem is some offices have 1 Port with 2 users and a printer. I want both users to authenticate via 802.1X and avoid trying to buy a 2960 8 port switch for 500$ just for 2 users.
If anybody has any suggestions or past experiences with a situation similiar to mine that would be great!
Cheers

HI. I have read a previous post that can confirm if Linksys switches support dynamic vlans. Check out the link below.
http://forums.linksys.com/linksys/board/message?board.id=Switches&message.id=4511

Yet another IAS + 802.1x dynamic vlan question

Similar Messages

Maybe you are looking for