Problem in 3548-x switch with dot1x in multiple VLAN assignment

[deepak.singh.rawat]

Hi,

Our Cisco switch -3548X on version 9.3.2 is having a dot1x port based feature is enabled and connected to a free radius server for authentication. We are trying to give the multiple Vlan in the Free radius server user file so that Cisco can allow our two Vlan 1968 and Vlan1969.

We are trying the below configuration in user file of freeradius server where we are giving the two Vlan but the cisco Auth vlan is coming as default.

Free radius user file config for Cisco switch

E23D213926.XXX.com Cleartext-Password := "54321"
Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802,
Tunnel-Private-Group-ID = "1968,1969"

Cisco Dot1x output

Dot1x Info for Ethernet1/11
-----------------------------------
PAE = AUTHENTICATOR
PortControl = AUTO
HostMode = MULTI HOST
ReAuthentication = Enabled
QuietPeriod = 60
ServerTimeout = 30
SuppTimeout = 30
ReAuthPeriod = 3600 (Locally configured)
ReAuthMax = 2
MaxReq = 2
TxPeriod = 30
RateLimitPeriod = 0
InactivityPeriod = 0
Mac-Auth-Bypass = Disabled

Dot1x Authenticator Client List
-------------------------------
Supplicant = 58:45:4C:E7:B3:42
Domain = DATA
Auth SM State = AUTHENTICATED
Auth BEND SM State = IDLE
Port Status = AUTHORIZED
Authentication Method = EAP
Authenticated By = Remote Server
ReAuthPeriod = 3600
ReAuthAction = Reauthenticate
TimeToNextReauth = 2639
Auth-Vlan = 1

If we give only one Vlan1968 then our setup is working but our node which need a authentication from cisco/free radius has a two vlan 1968 and 1969 , So we are not able to reach the default GW of 1969 vlan if we put only one vlan assignment in Radius server.

Regadrs,

Deepak Rawat

[Karsten Iwen]

With "HostMode = MULTI HOST" you can only have one VLAN which is set by the first authentication that happens on that port. Other systems on that port use that VLAN (and other authorisation-settings) piggyback.

What do you want to achieve that you want to assign two VLANs in your setup?

[deepak.singh.rawat]

Hi Karsten,

Thanks for reply.

Actually our node has two vlan setup one for connectivity(1968) and other is for Voice(1969) so we want both VLAN should be allowed so that our both function can work simultaneously. Multihost is given because we have more than one node in cascaded setup and first node which is directly connected to cisco port is the authenticator for second node and so on.

[MHM Cisco World]

Hi Are this issue still not solved?
can I see the config of interface ?

[deepak.singh.rawat]

Hi,

Is their anyone who can guide us or reply to this problem.

[deepak.singh.rawat]

Dear Experts,

Any help, We are still looking for answers.

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/98523-8021x-cat-layer3.html

check this link for config 

[deepak.singh.rawat]

Hi,

The problem got solved now

Solution: the issue in the lack of accounting stop messages, so we added accounting to the switch

Regards,

Deepak