topic Re: Configuring 802.1X port-based authentication with VLAN assig in Network Access Control

Configuring 802.1X port-based authentication with VLAN assignment

tvanginneken — Sun, 10 Mar 2019 14:26:47 GMT

My client-pc is connected to a C2950 switch that is configured for 802.1X port authentication. The C2950 switch forwards the pc authetication request to a Cisco ACS Radius server version 3.2.

Which RADIUS attributes need to be set on ACS Radius server to use VLAN assignment and what TAGs do I need to set (0,1 or 2) and what values need to be set for these radius attributes. Up to now I have found the following attributes in the documentation:

[64] Tunnel-Type=VLAN

[65] Tunnel-Medium=802

[81] Tunnel-Private-Group-ID=vlan-name

I tried these attributes but it doesn't work.

The documentation does not specify the TAGs I should use.

Could someone help me out please??

Thanks!!

Regards,

Tom

Re: Configuring 802.1X port-based authentication with VLAN assig

mschooley — Thu, 14 Aug 2003 17:14:34 GMT

those are the only 3 attributes needed, make sure dot1x is globally enabled, I can't remember, does the 2950 run ios like code, if so you can use debug aaa authe, debug radius, and debug dot1x all, this will tell you what radius server is passing back for vlan id. Do you need to log onto a domain or run login scripts, if so you're going to have a lot more problems. Are you running peap or md5.

Re: Configuring 802.1X port-based authentication with VLAN assig

tvanginneken — Sat, 16 Aug 2003 12:24:28 GMT

Hi,

thanks for the reply. The authentication of the user works fine, and I see the RADIUS server passing the VLAN info to the switch. But the debug dot1x output on the switch says: no VLAN.

Do you know the tags and values I have to use on the radius server? Thanks!!

Regards,

Tom

Re: Configuring 802.1X port-based authentication with VLAN assig

mschooley — Mon, 18 Aug 2003 11:35:28 GMT

did you put the correct vlan name, no vlan id, but the actual name.

Re: Configuring 802.1X port-based authentication with VLAN assig

anar — Thu, 21 Aug 2003 11:49:45 GMT

Hello I've successed in that. here is config enough to run it properly:

aaa new-model

aaa authentication dot1x default group radius

aaa authorization network default group radius

aaa authorization configuration default group radius

dot1x timeout quiet-period 20

interface FastEthernet0/2

switchport mode access

no ip address

dot1x port-control auto

spanning-tree portfast

On the ACS in IETF Radius attributes

[064] tag1 VLAN

[065] tag1 802

[081] tag1 11 (note, not vlan name)

It must work

Re: Configuring 802.1X port-based authentication with VLAN assig

mschooley — Thu, 21 Aug 2003 17:14:43 GMT

for 81 tag 1, I'm using vlan name adm2, and it works fine, although still having problems with microsoft client and dhcp, should have a patch from microsoft in a couple of weeks.

Re: Configuring 802.1X port-based authentication with VLAN assig

anar — Wed, 27 Aug 2003 12:31:05 GMT

I have the same problem.I've tried all possible methods to dynamically assign ip address to aaa

clients, but it doesn't want to work. Debugging shows that, ip address assigned either to client itself or to group client belongs to, passed successfully to the switch. What then ?:(

Re: Configuring 802.1X port-based authentication with VLAN assig

mschooley — Wed, 27 Aug 2003 16:26:13 GMT

microsoft put out a patch today, I'm going to test it this week, it is supposed to renew ip address after user authenticates.

Re: Configuring 802.1X port-based authentication with VLAN assig

dengqi — Thu, 28 Aug 2003 00:10:04 GMT

Mike, I search through Microsoft website but can't find the patch when you mentioned. Can you help to paste out the name and url of the patch? Thanks

Re: Configuring 802.1X port-based authentication with VLAN assig

mschooley — Tue, 02 Sep 2003 14:56:51 GMT

just emailed microsoft, they said it isn't being released until tested, but if you contact microsoft support, they can give you the hot fix, or email me at jschooley@csc.com

Re: Configuring 802.1X port-based authentication with VLAN assig

mcnaz-yeo — Sun, 28 Sep 2003 02:35:38 GMT

Can U share with me how do U configure your 802.1x step and what should it be configure @ the ACS .

Could U help thanks

Regards

Re: Configuring 802.1X port-based authentication with VLAN assig

mschooley — Mon, 29 Sep 2003 12:05:08 GMT

anything in particular? ACS is fairly easy, set the 3 attributes that it mentions in all the docs, and use external nt database. If you are using login scripts, roaming profiles, or just about anything that you would use in real network environment, you will need to use active directory, enable machine authentication, add a certificate to the local machine store, add a registry value called Supplicant Mode and set the value to 3, then add the microsoft hotfix. I will post the microsoft article reference number as soon as email starts working

Re: Configuring 802.1X port-based authentication with VLAN assig

mcnaz-yeo — Mon, 29 Sep 2003 13:07:25 GMT

I trunk the cisco 2950 with our core switch so I given the IP as 192.168.188.28, I assign this ip with the key name cisco use it as cisco (ITEF) am I right here

I've a active directory which work fine on my wireless network with EAP-TLS & PEAP. But I cant figure out on 802.1x on point to point setting please advise , which micorsoft patch should I patch

Thanks

Regards

Re: Configuring 802.1X port-based authentication with VLAN assig

mschooley — Mon, 29 Sep 2003 13:39:46 GMT

have you set up the AAA commands and the radius server on the switch yet?

Re: Configuring 802.1X port-based authentication with VLAN assig

mcnaz-yeo — Tue, 30 Sep 2003 03:55:42 GMT

Can U advise Please, which site provide step for me to follow thanks

Regards

Re: Configuring 802.1X port-based authentication with VLAN assig

mschooley — Tue, 30 Sep 2003 11:57:17 GMT

http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_guide_chapter09186a00800da6ff.html

Re: Configuring 802.1X port-based authentication with VLAN assig

mcnaz-yeo — Tue, 30 Sep 2003 12:59:28 GMT

I 've tried to configure using the following command on the 2950 Cisco Switch

2950# configure terminal

2950(config)#aaa new-model

2950(config)#aaa authentication dot1x default group radius enable

2950(config)#dot1x max-req 3

2950(config)#dot1x timeout quiet-period 0

2950(config)#dot1x timeout re-authperiod 1

2950(config)#radius-server host x.x.x.32 auth-port 1812 acct-port 1813 key 123

2950(config)# interface fastethernet 0/1

2950(config-if)# dot1x port-control auto

2950(config-if)# end

On the ACS I configure as cisco(ITEF) withe the switch IP and key 123

But when I try use peapon XP SP1 0s with the debug I encounter ABORT on the authenication , Can U point out where did I went wrong

Thanks

Regards

Re: Configuring 802.1X port-based authentication with VLAN assig

mschooley — Mon, 06 Oct 2003 13:16:01 GMT

can you post the debug, debug aaa auth, and debug radius

Re: Configuring 802.1X port-based authentication with VLAN assig

kalyanccie — Thu, 30 Oct 2003 08:55:49 GMT

Dear mschooley

i have tried the same configuration, a vlan is dynamically assigned to the dot1x user, as i am able to ping only that particular vlan. An ip is going out from ACS to switch , but then it vanishes.

Any help , greatly appreciated.

regards

kalyan

Re: Configuring 802.1X port-based authentication with VLAN assig

dengqi — Wed, 12 Nov 2003 07:35:35 GMT

Hi Mschooley,

Have you tried Microsoft patch 822596? How is it? I tried this patch but met some problem. The client will ping its default gateway after receiving Authentication sucsessful message from switch. If the client can't ping the gateway, it will do a IP address renew. But I find the switch is a bit slow in switching vlan. When client ping default gate, the vlan is not switched yet. And it causes the client fail to get new IP address. Have you met this kind of situation?

Thanks and Regards

Deng Qi