topic Re: Authenticating Trunk Ports - VLAN list in Network Access Control

Authenticating Trunk Ports - VLAN list

John Quick — Mon, 11 Mar 2019 05:39:04 GMT

I have a requirement to authenticate trunk ports to wireless access-points on our Cisco switch, By default all ports are access ports and we run MAB authentication. I have managed to change the port to a trunk using Cisco-av-pair attribute in ACS (cisco-av-pair = deivce-traffic-class=switch)

My problem now is that I need to add a VLAN allowed list on the port once it has changed to a trunk port (switchport trunk allowed vlan x,y,z). ideally we would not want to statically assign the VLAN's on each port as an AP could be on any port and may wish to authenticate other trunk ports using different VLAN's in the future. Below is the configuration used on the ports.

cisp enable
!
interface FastEthernet0/2
description *** Client Device ***
switchport access vlan 2
switchport mode access
no logging event link-status
authentication event fail action next-method
authentication event server dead action reinitialize vlan 3
authentication event server alive action reinitialize
authentication order mab dot1x webauth
authentication priority mab dot1x webauth
authentication port-control auto
authentication fallback GUEST_FALLBACK
mab eap
dot1x pae authenticator
dot1x timeout tx-period 3
dot1x timeout supp-timeout 10
dot1x max-reauth-req 1
dot1x timeout auth-period 600
no cdp enable
spanning-tree portfast

Any help will be greatly appreciated.

Thanks
John

Re: Authenticating Trunk Ports - VLAN list

dmurech0488 — Fri, 09 Mar 2018 16:41:39 GMT

I am looking at doing something similar to this for some flexconnect APs that I want to deploy. I would imagine that adding a switchport trunk allowed vlans x,y,z to the initial port config would suffice and that the access vlan would become the native vlan for the trunk.

Is this what you did or did you accomplish this some other way?

Re: Authenticating Trunk Ports - VLAN list

Octavian Szolga — Mon, 12 Mar 2018 15:56:33 GMT

Hi John,

Even if you change the switchport mode to trunk, I'm not sure you'll be able to pass client's traffic because each MAC will have to be authenticated from switch perspective.(you'll need most likely a multi-host mode, so that one MAC - AP - would grant access to all MACs.

Stil, multi-auth would usually place all other MACs into the same VLAN of the first authenticated host. You have to double check.

Still, the good news is that you can use a service-template (I don't have ISE interface available now to check - this is how I remeber it's called - it's one of the first options in the authz profile settings) and send to the switch a specific string. When that string is received, the switch can apply a macro to your interface doing what you don't want to do manually 🙂

Just a quick hint:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/15-1/XE_330SG/configuration/guide/config/automacr.pdf

I don't have anything more specific now, but I think that will do.

Thanks,

Octavian