topic Re: Auth VLAN on third party switch in Network Access Control

Auth VLAN on third party switch

wileong — Thu, 11 Oct 2018 15:11:44 GMT

Hi,

Working on Brocade switch using Auth VLAN for Posture flow. Auth VLAN approach works fine in single PSN. How do we scale to multiple PSN using Auth VLAN?

When try to configure DHCP scope on both PSN1 and PSN2 using same IP segment but IP address assignment is unique there is an error.

Error during saving DHCP scope. Any idea?

Thanks

Wing Churn

Re: Auth VLAN on third party switch

Jason Kunst — Thu, 11 Oct 2018 15:18:58 GMT

Its not supported to run same subnet on different PSNs. I assume for redundancy you’re doing this? I have heard this in the past would recommend you reach out via account team for a feature request

Re: Auth VLAN on third party switch

wileong — Thu, 11 Oct 2018 15:32:49 GMT

Hi Jason,

Understood on the redundancy is not available today. How about the error of creating none overlapping DHCP scope for the third screenshot i provided? The second scope i am creating is not overlapping with existing created scope, do we have any known bug on this. By the way, we are running ISE 2.2p9

Thanks

Wing Churn

Re: Auth VLAN on third party switch

Jason Kunst — Thu, 11 Oct 2018 15:34:58 GMT

It’s the same subnet correct? Regardles of nonverlapping status its not supported

Re: Auth VLAN on third party switch

wileong — Thu, 11 Oct 2018 15:40:11 GMT

Sorry, my attached image might be confusing but the DHCP scope is not overlapped.

Re: Auth VLAN on third party switch

Jason Kunst — Thu, 11 Oct 2018 15:43:58 GMT

It’s the same subnet. The network ID is the same therefore it won’t work. It doesn’t matter if you split the scope where 1 PSN serves part of the scope and the other part on another PSN (this works in Microsoft DHCP server but not on ISE design).

Re: Auth VLAN on third party switch

wileong — Thu, 11 Oct 2018 15:47:11 GMT

I think you are still misunderstood. Ignore those images, i am creating 2 totally different subnets and still get this error. Do we have any known issue around DHCP scope? If not, i will get partner to raise a TAC case.

Re: Auth VLAN on third party switch

Jason Kunst — Thu, 11 Oct 2018 15:49:58 GMT

If its different networks then open a tac case