I'm using a C2950 with the image
c2950-i6q4l2-mz.121-22.EA1.bin for 802.1x authentication against Cisco ACS.
Authentication is successful but I'm not able to assign a VLAN to the port. From Radius debugs, I can see that the switch is receving attributes 64, 65 and 81:
02:57:07: RADIUS: Received from id 55 192.168.1.100:1812, Access-Accept, len 118
02:57:07: Attribute 6 6 00000001
02:57:07: Attribute 11 5 31303140
02:57:07: Attribute 64 6 0100000D
02:57:07: Attribute 65 6 01000006
02:57:07: Attribute 81 11 01564C41
But debug dot1x tells that:
03:02:14: dot1x-ev:dot1x_port_authorized:supplicant 0000.e282.dd30 is first, old vlan 1, new vlan 0
03:02:14: dot1x-ev:dot1x_port_authorized: Host-mode=0 radius/guest vlan=0
03:02:14: dot1x-ev: GuestVlan configured=0
And the port stays in VLAN 1
The configuration on the switch is as follows:
--------
aaa new-model
aaa authentication login default none
aaa authentication dot1x default group radius
aaa authorization network default group radius
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
dot1x system-auth-control
interface FastEthernet0/5
switchport mode access
dot1x port-control auto
spanning-tree portfast
radius-server host 192.x.x.100 auth-port 1812 acct-port xxx key cisco
radius-server retransmit 3
radius-server vsa send authentication
----------
On the ACS I have created a user with attributes 64,65 and 81. For att. 81 I have use vlan ID and name but with no luck.
Has someone else been able to configure this successfully. It should be a simple configuration, but it's not working.
