8021q port configuration with 802.1x multi-auth with web redirection

[nhedhili]

Hello Gents,

we need to configure 802.1x feature on a truck port ( 802.1q) of a catalyst switch , does this work without any trouble 

with the two features on the same port. 

this scenario is required because we have a third party access point with 802.1q port with multiple vlans and per vlan ssid connected to the switch for which we need to do 802.1x authentication for the clients and fo which we will do later web redirection to ise hotspot.

-access point used is ubiquity 

-switches used are catalyst 2960 and 3560

Thanks for your help and assistance 

[Arne Bier]

Hi

BTW: It's not just "gents" on these forums ;-)

Enabling 802.1X on a switch port enables 802.1X between the switch and the attached device. In this case it would allow the AP to authenticate itself (not its clients) to the switch.  E.g. Cisco AP's can be configured to join an access switch via EAP-FAST.  This means that enabling 802.1X on a switch port talks only to the directly attached devices.

Don't get confused between the 802.1X that then later runs on the Enterprise WPA SSID serving your clients!  This all happens in the AP (or the WLC) and the wireless network becomes the Authenticator (not the access switch).  When a wireless client associates to an Enterprise SSID, then it will talk 802.1X to the AP/WLC, and not to the switch.  Once association is complete, the client will be dropped into a VLAN.  Now trunking comes into the picture (in the case of FlexConnect)

[nhedhili]

Thank you for your reply , since we have a third party access point connected to the port of the switch ( ubiquity unify )  and not a cisco AP  what is your recommandation for doing web redirection to our ise hotspot for the clients connected from the wireless network :

the way we thinked to do is to make the switch port as multi-auth and configure MAB on it for the aothentication method without configuraation of the mac address in the ISE than definig a rule for all unknown mac devie to be redirected to the guest web hotspot 

[Arne Bier]

That might work.  I can't say for sure because I have only dealt with enterprise gear like Cisco and Aruba APs.  But I still wonder what the switch auth has to do with your client auths on the SSID?  Is the SSID bridged to the switch port?  In my experience the SSID terminates on the AP itself and the AP becomes the authenticator - not the switch.

I haven't a clue.

[nhedhili]

Thank you for your reply , I will try that I let you know.

We think about this methodology as an escape because we have behind an ubiquity switch and I have searched for the ubiquity radius  disctionary , there is no informations on it and the few information that I have lets me think it does not seem to be reach enough

thanks and regards