topic Re: Flexconnect AP Native vlan in Network Access Control

Flexconnect AP Native vlan

OdenseKommune — Thu, 30 Mar 2017 12:25:01 GMT

I new to ISE and so is my colleague, and we are still learning a lot.

We have run into a problem regarding getting a native vlan, on a port that we connect a Cisco 3602I Access Point to.

The 802.1x works like a charm.

The AP Native VLAN is 666

And our switch port config is below.

My question is how we get a native vlan of 666 on the port?

Default port config:

switchport access vlan 5

switchport mode access

switchport nonegotiate

ip arp inspection trust

authentication event server dead action authorize vlan 40

authentication event server alive action reinitialize

authentication host-mode multi-auth

authentication order dot1x mab

authentication priority dot1x mab

authentication port-control auto

authentication periodic

authentication timer reauthenticate server

authentication violation restrict

mab

dot1x pae authenticator

dot1x timeout tx-period 10

spanning-tree portfast

ip dhcp snooping trust

Regards,

Brian Møller

Re: Flexconnect AP Native vlan

Dustin Anderson — Thu, 30 Mar 2017 17:35:38 GMT

Are you looking to just set the port to 666?

switchport access vlan 666

Or are you looking to have ISE change the vlan?

This should be able to be done by the result of the rule.

I have not tried this via wired, so there may be some other config needed.

Re: Flexconnect AP Native vlan

OdenseKommune — Thu, 30 Mar 2017 21:20:21 GMT

Hi Dustin

Sorry i forgot a few ekstra informations in my first post.

We want the AP-port to have this ekstra config, or something simelar that works:

switchport mode trunk

switchport trunk native vlan 666

Regards,

Brian

Re: Flexconnect AP Native vlan

Dustin Anderson — Thu, 30 Mar 2017 21:29:34 GMT

OK, I think what you may want is to set an interface template.

Identity-Based Networking Services Configuration Guide, Cisco IOS Release 15E - Interface Templates [Cisco IOS 15.2E] …

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ibns/configuration/xe-3e/ibns-xe-3e-book/ibns-int-temp.pdf

Granted it looks like it's dependent on ios version on the switch.

You could then call the template in the result on ISE.

Re: Flexconnect AP Native vlan

hslai — Sun, 02 Apr 2017 07:56:08 GMT

You might want to take a look at this -- Configure to Secure a Flexconnect AP Switchport with Dot1x

Re: Flexconnect AP Native vlan

OdenseKommune — Tue, 04 Apr 2017 13:11:18 GMT

Hi Dustin and hslai

Thnx for the answers.

My Colleague and i will look at them and see what we can do.

Thnx

Re: Flexconnect AP Native vlan

hariholla — Tue, 04 Apr 2017 16:28:22 GMT

Use interface-templates.

run "show derived-config <interface>" to see the actual config applied on the port. The running-config won't change.