Vlan 200 "Unauth-Vlan", 10.14.0.0/24, VRF "Unauthenticated"
Vlan 240 "Auth-Vlan", 10.200.0.0/24, VRF "Authenticated"
WoL "magic" packet on UDP 402
ip-helper addresses and ip directed-broadcast configured correctly.
Core and Distribution are 9500's on 17.6.4, Edge are 9300's on 17.3.3
We are using Cat 9k switches, ISE and Wake-on-Lan. All switch ports have the same default configurations with 802.1x and are assigned to Vlan200. When a Windows PC is connected, they match an ISE policy, are authenticated and are dynamically assigned to Vlan240 and a DACL "permit ip any any". Now the PC is up and running, a Symantec Altiris Agent, installed in Windows, updates the Altiris Server with it's current IP address (10.200.0.2) on Vlan 240 (Auth-Vlan). At this point WoL works.
When the PC is powered down or goes to sleep, the switch port unauthenticates and falls back to Vlan200 (Unauth-Vlan). Because the Altiris Agent is no longer running it can't update the Altiris Server with it's current IP of 10.12.0.5. The Altiris Server lists this PC as still having its previous IP of 10.200.0.2, so it broadcasts the "magic" packet to the Auth-Vlan and not the Unauth-Vlan, so we can no longer Wake the PC's up.
Is there a way in the CLI to duplicate this "magic" packet? If the "magic" packet is sent to Vlan240, can it also be sent to Vlan200?
I reached out to Cisco about using Vlan-Bridging / fallback-bridging, but they replied saying that this feature has been deprecated and is no longer supported.
I realised after submitting this post that the duplicated packet would need its destination broadcast address changing, so if the packet had destination broadcast of 10.200.0.255, this would need changing to 10.12.0.255 when sent to the other Vlan, so maybe this can't be done in CLI. But any suggestions are welcome.
Thanks,
Jon.
