topic Re: 802.1x VLAN assignment + Microsoft IAS in Network Access Control

802.1x VLAN assignment + Microsoft IAS

BABARCHE — Sun, 10 Mar 2019 14:15:21 GMT

Hello,

Here is what I am tring to do:

a Windows XP client is authenticating via 802.1x to a cisco switch. The switch "talks" to a IAS radius serveur (microsoft). That works fine, the user can login and the port opens up. Cisco developed a feature in a recent software release whereby the radius server can also tell the switch what VLAN to place the freshly-authenticated port in (that's the part I can't get to work - the fact that I am totally new to Radius probably doesn't help either). I know that the switch expects the following parameters within the Access-accept:

a) Tunnel-Type(#64)=VLAN (13)

b) Tunnel-Medium-Type(#65)=802 (6)

c) Tunnel-Private-Group-ID(#81)=VLANID

How Can I define these parameters in IAS ? I tried severals things but know one worked. If someone has experience, please let me know .... Thanx !

Bastien

Re: 802.1x VLAN assignment + Microsoft IAS

hadbou — Tue, 22 Apr 2003 14:55:25 GMT

Check if the tag field for tunnel attribute is set to 1 instead of the default value of 0 in the Microsoft IAS server.

Re: 802.1x VLAN assignment + Microsoft IAS

BABARCHE — Tue, 22 Apr 2003 15:27:52 GMT

thanx for your answer.

Thanx for your answer.

I tried that but I think I made mistakes because it

doesn't work.

What I need to know is what I have to enter precisely :

- Which kind of attribute ? Cisco AVPAIR or radius vendor

specific attribute or something else ?

- Which value in the field : Tunnel-Type(#64) or just 64

or just Tunnel-Type or just #64 or 13 ?

- Which value in the field atttribute format ? string,

decimal or hexadecimal ?

Thanx very much !!

Re: 802.1x VLAN assignment + Microsoft IAS

BABARCHE — Tue, 22 Apr 2003 15:55:25 GMT

ok ! forget my previous mail.

I found how to define the attributes in IAS.

But it stills not working. I don't found where I can change this flag you're talking about. Could you help me ?

Thanx ...

Re: 802.1x VLAN assignment + Microsoft IAS

fbarook — Thu, 24 Apr 2003 05:16:10 GMT

I also had a similair problem, I was using a steel belt radius. I changed the

ACS radius flag and it worked for me.

Re: 802.1x VLAN assignment + Microsoft IAS

BABARCHE — Thu, 24 Apr 2003 13:59:19 GMT

Ok ... Thanx ... I still do not find where to change this flag in IAS ....

Could you send me your switch configuration which work fine for VLAN assignment with 802.1x. It could help to see if I didn't make any error in mine.

Thanx very much !

Bastien

Re: 802.1x VLAN assignment + Microsoft IAS

BABARCHE — Tue, 29 Apr 2003 13:06:21 GMT

Sorry, It works !

I just made a stupid mistake. I forgot the command "aaa authorization network default group radius".

No need to change a flage or something like that. IAS works fine. But it's not very easy to manage groups compared to ACS.

So, if you plan to do VLAN assignment with 802.1x, I advise to use CiscoSecure ACS. If you just need to do 802.1x authentication, then IAS is great to !

Bye ...

Re: 802.1x VLAN assignment + Microsoft IAS

mschooley — Thu, 26 Jun 2003 16:59:53 GMT

what did you set the tunnel type value to, I did not see vlan, just vtp?

Re: 802.1x VLAN assignment + Microsoft IAS

dengqi — Thu, 11 Sep 2003 07:36:38 GMT

I'm trying to use Win2003 IAS for 802.1x authentication. But the event log of IAS keeps giving me the error message"A malformed RADIUS message was received from client XXX. The data is the RADIUS message." I have checked that the radius key is correct. Anyone know what the problem is?

Re: 802.1x VLAN assignment + Microsoft IAS

buntschu — Wed, 20 Oct 2004 07:33:33 GMT

Hi,

We have the same configuration as you, but the IAS Radius reject the authentication request from the NAS (Cat 2959). Could you provide some tips (or printscreen) of your IAS config ? Our config works fine with ACS 3.3 but we would like to migrate it to IAS.

Thanks for your reply !

Francois

Re: 802.1x VLAN assignment + Microsoft IAS

andrea.meconi — Wed, 20 Oct 2004 08:51:01 GMT

Look at http://www.foundrynet.com/solutions/appNotes/8021xportAuth.html#other8021xtested.

A good guide! and remember the command:

aaa authentication dot1x default group radius

Configure IAS as your radius server on switch.

With my 3550 it's work fine!

Andrea.

Re: 802.1x VLAN assignment + Microsoft IAS

peter — Tue, 21 Dec 2004 05:52:20 GMT

denggi, did you have an luck in resolving this problem? I can get 802.1x working with a Cat3550 and Cisco ACS but when I try using Microsoft IAS I get a similar message to yours.

Any help would be great.

Re: 802.1x VLAN assignment + Microsoft IAS

aarons — Tue, 15 Mar 2005 13:10:06 GMT

You are using IAS? If so are you using vendor-specific attributes or cisco avpairs?? Anyone in a similar boat?

I cannot get this to work.