Help with Disconnecting Users via Wi-Fi in 802.1X Deployment (Cisco SG

[njaudon]

Hi all,

I am currently deploying 802.1X in my company and I’m trying to figure out how to disconnect a user via the Wi-Fi network. My main question is that I can’t find anything in the documentation regarding the Cisco SG 550X-48P switch supporting PoD (Packet of Disconnect) or CoA (Change of Authorization).

I don’t understand why it’s stated that the switch supports 802.1X, but there is no mention at all of these important protocols. These features aren’t even listed, while the documentation explains each command in detail. I am looking for an alternative command or approach to achieve this, as it’s not addressed at all in the documentation.

Is my request clear, or is something unclear here? Any help or insight would be greatly appreciated! Is there an alternative command, or is this just not supported by the switch?

Thanks!

[Flavio Miranda]

@njaudon 

Datasheet does not mention explícity CoA but It mention dynamic vlan assignment, which uses CoA.

IEEE 802.1X (authenticator role)

RADIUS authentication and accounting, MD5 hash, guest VLAN, unauthenticated VLAN, single/multiple host mode, and single/multiple sessions Supports time-based 802.1X dynamic VLAN assignment

[Karsten Iwen]

In contrast to @Flavio Miranda, I don't see any CoA here. The initial dynamic VLAN is assigned without CoA. Only if there has to be a VLAN change, CoA is needed. But this is probably not a Small Business Use Case.

Then you mention that you want to do the disconnect for Wi-Fi users but only mention a switch. In case it is not Wi-Fi but a wired use case, you likely could achieve the same result with SNMP.

[njaudon]

Hello, thanks for your reply, but it seems that FreeRADIUS does not support SNMP, if I’m not mistaken. The native SNMP support in FreeRADIUS version 2 and later is broken. According to the documentation, there is an option to obtain information about the server's status and statistics via the status server, but this is not the same as SNMP. It is possible to use a Perl script as an interface to act as an SNMP sub-agent via the AgentX protocol, but this is not a native or directly supported solution by FreeRADIUS.

Regarding SNMP documentation: Native SNMP support in FreeRADIUS version 2, but I haven't tried using the Perl module. Could you provide more details on how SNMP can be used to deauthenticate a user?

[Karsten Iwen]

If you want to reauthenticate the Wi-Fi user, you have to send the CoA to your Controller or AP, whichever did the authentication. The Switch is only relevant for wired clients. If there is a "Reauthenticate now" button on the switch, it is not meant to be CoA because this authentication can be directly triggered by the Authenticator. CoA is intended to be triggered by the authentication server to the authenticator. And again: The switch is the Authenticator for wired clients, the Controller/AP is the Authenticator for wireless clients.

[njaudon]

Thank you for your response, but I would like to clarify a few things.

In my setup, the Aruba P22 AP is connected to the Cisco SG 550X switch, and the switch communicates with the FreeRADIUS server. I understand that for Wi-Fi clients, the AP (or controller) acts as the authenticator, and for wired clients, the switch is the authenticator.

Regarding the CoA request, I believe there may have been some confusion. Since the AP is connected to the switch, when I send a CoA request from FreeRADIUS, it should go through the switch to reach the AP, as the AP is directly linked to it.

That being said, I will further investigate how to trigger a CoA or PoD request directly from the AP, as it seems that sending it from FreeRADIUS to the AP through the switch can be the correct approach, need to know now if i have a console command or something like that on my aruba i don't think so.

I appreciate your insights and will look into this further.

[MHM Cisco World]

Sorry' but you mention wifi user and then ask for SW.

Can you more elaborate 

MHM

[njaudon]

Hi all,

Just to clarify, I have FreeRADIUS, a Cisco SG 550X-48P switch, and an Aruba P22 access point. I am using dynamic EAP-TLS authentication, and VLANs are being assigned dynamically based on AD groups via LDAP, which works correctly for both Wi-Fi and Ethernet connections.

What I’m trying to do now is disconnect a specific user from the Wi-Fi network. I came across the "Reauthenticate Now" button on the switch, which works, but it does not seem to utilize PoD (Packet of Disconnect) or CoA (Change of Authorization) as I initially thought. When I tried sending a CoA request from the RADIUS server, it didn’t work, and that’s when I attempted to send a disconnect request directly from the switch. However, I couldn’t find any relevant command for that in the documentation.

The issue with the "Reauthenticate Now" button is that it does not actually trigger PoD or CoA, but instead simply forces a reauthentication of the client, which doesn’t achieve the same result as disconnecting or deauthorizing the user from the network. Furthermore, the "Reauthenticate Now" button works only for wired connections, and to disconnect a Wi-Fi user, I would first need to revoke the user's certificate, then "reenable" authentication using the button.

I also tried reauthenticating on the port where my Aruba P22 is connected, but it doesn’t seem to reauthenticate the users, possibly due to the fact that the authorization timeout is set to 1 hour.

As I work in a fairly large company, this approach doesn’t solve the problem for Wi-Fi users, and it’s quite time-consuming to implement for every user.

I’ve reviewed the switch documentation thoroughly, but I didn’t find any mention of PoD or CoA functionality. Could you confirm whether there is any other way to disconnect a Wi-Fi user or if these features are simply not supported by the switch?

Thanks for your help!

[njaudon]

Note* i contact the aruba support, and i don't have a cli for make command directly on the aruba