cisco sg250 switch for network access control

[benv]

i am deploying a 3rd party nac solution with a cisco sg250 10port switch

on the gui interface of the cisco sg250 switch i see 802.1x configuration which was properly configured

however when a user connects to the interface of the switch for 802.1x, on the 3rd party nac solution i see radius authentication rejected for username\domain

please advise if the cisco sg250 switch is considerable for 802.1x or just has basic 802.1x functionality

thanks

[balaji.bandi]

how is your user source configured on the NAC (is this from AD?)

other than just basic config on the switch side and switch added to your NAC, that should work as expected :

below for reference in case you missed any options - as per the message look like far end issue (I am in guess)

https://www.cisco.com/c/en/us/support/docs/smb/switches/cisco-220-series-smart-switches/smb5357-configure-802-1x-port-authentication-on-the-cisco-sx220-seri.html

[benv]

Thank you balaj

user source is from AD

We have done the configuration based on that article you share

However we are not completely sure if the cisco SG250 switch is compatible for an 802.1x

[balaji.bandi]

as per the switch concerns the switch capable of 802.1x, you need to check with NAC ( I am sure they do support I guess)

i see radius authentication rejected for username\domain   - this means the request was processed and failed somewhere in the path.

[benv]

Thank you

This article you posted is for SX 220 will the same configuration work for SG250?

Also while reading the article below it appears the SG250 might work for radius auth but definitely not for VLAN Assignment

https://community.cisco.com/t5/small-business-switches/radius-supplied-vlans-for-sg250-switches/td-p/4144726/page/2

[balaji.bandi · Accepted solution]

check the Emulator i do see the option :

https://www.cisco.com/assets/sol/sb/SG220_Emulators/SG220_Emulator_v1-0-0-18_20140626/home.html

check admin guide :

https://www.cisco.com/c/en/us/td/docs/switches/lan/csbms/250_/2_5_7/Admin_guide/tesla-250-ag/cb_250_chapter_15.html#ID-00005d6d

[pieterh · Accepted solution]

>>> on the 3rd party nac solution i see radius authentication rejected for username\domain <<<

looks like the switch is talking properly to the 3rd party NAC device
but the radius request from this device to AD gets a "rejected" response
-> the NAC profile is not properly matchet or the user does not belong to the correct group to use NAC
-->> check your AD setitngs (not switch)

[benv]

Thank you for you response

yes you are correct we had issues with the AD connection this is now resolved