Recommended Posts

Is it possible for a radius server to assign vlan dynamically on a switch port that is on a dummy vlan before it gets authenticated?

 

What I mean if a domain PC connects to a switch port assign vlan 3180 - 3189 (these are client vlans), if it is a printer assign it to vlan 3017 and if it is a guest user assign it to vlan guest and send it to a web portal for registration. Is this even possible or I am thinking way out of the box?

Link to comment
https://www.neowin.net/forum/topic/1354172-dynamic-vlan-assignment-with-radius/
Share on other sites

There are many ways to assign vlan based upon criteria - mac, auth to radius sure.. What switch(es) do you have?  Your 30$ smart switch not going to be able to do this sort of thing ;)

 

Sounds like your wanting to implement a NAC... Check out https://packetfence.org/

 

If your a cisco shop it would be ICE.. But not free ;)  https://www.cisco.com/c/en/us/products/security/identity-services-engine/index.html

Great, then what I am trying to do will work somehow. Haha, my switch cost almost 1000$ :p

 

I am going to use ISE and what I want to do is: Dot1X and MAB, but if the user is not found in the AD or ISE DB should be redirected to a guest web portal for registration. Now if when I assign the port to a specific vlan for dot1x it works fine, i.e client vlan, but it will not change vlan to guest vlan after the registration is done.

 

So now I want to assign all ports to a dummy vlan i.e 999 and after switch port is authenticated for domain pc's it should move them to client vlan and the same for printer vlan. Guest should be moved from dummy vlan to guest vlan after the registration is done.

This is a common setup where device gets dumped into restricted vlan until they auth in some manner, fill out info in a captive portal could sure be one of those options.

 

I am quite sure ISE can do that... I would open up a tac case with cisco if your having problem with specific configuration option not working etc,

Good to know it is possible, have you done this before?

Yeah, I am sure ISE can do it. The problem is that ISE 2.3 they have re-done everything and there aren't a lot of documentation so read and the older ones aren't really applicable.

 

I will open a tac case, but wanted to make sure that it is possible from radius perspective.

Sure when I get to work in the morning I will post up some info..

 

Got called so a bit early this morning.. Freaking circuit can not stay up for more 30 days at a time without a freaking issue... Arrrggh ;)

  On 23/01/2018 at 22:27, nabz0r said:

Is it possible for a radius server to assign vlan dynamically on a switch port that is on a dummy vlan before it gets authenticated?

 

What I mean if a domain PC connects to a switch port assign vlan 3180 - 3189 (these are client vlans), if it is a printer assign it to vlan 3017 and if it is a guest user assign it to vlan guest and send it to a web portal for registration. Is this even possible or I am thinking way out of the box?

Expand  

 

 

Here is what happens in my scenario.

Vlan 1 is an unconfigured vlan.  Vlan1 is essentially shut down. 

If an unauthenticated computer/device somehow holds the port open, that computer/device resides on vlan1.  Vlan1 has no IP or subnet, it routes no where.  Most of the time, if a computer can't auth the port goes into an administrative shutdown state.  If I plug my fluke LinkRunner in, it holds the port in an online status and it gives me the port info and the configured vlan of 1.

 

If a computer gets authenticated, Radius then pushes out what vlan that port can communicate on.

 

I think that is the scenario that you are looking for...a dummy vlan (The default vlan of the switch, which should always remain unconfigured).

 

802.1x doesn't really support a "portal".  You can configure the switch to use the default vlan for all else to belong to a vlan that has portal access (your default vlan for the access port)....

 

in my switch I would do this as an example:

int gi1/0/1

switchport mode access

switchport access vlan 3017

authentication order

authentication port control auto

mab

dot1x pae authenticator

spanning-tree portfast edge

 

This would put all unauthenticated computers on vlan 3017

 

It kind of urks me a little that the 2960x series has a different state of cli instructions, how the x series has depreciated commands where the xr series they continue to live and breathe in.

For you, you may want to look at this and look at the guest vlan settings or 802.1x Authentication with Restricted VLAN:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_010000.html#ID737

 

@BudMan, I actually have seen that link and he uses NPS, not ISE. I have figured it out and my ISE is now doing all the job with a little help of Ative directory and I am going to use ISE for authentication and command authorization based on AD group for network department, today we're using local username which is NO good.

 

@sc302, Yes, that is the scenario I was looking for. All switch ports are assigned a dummy vlan, though not vlan 1 and when a device gets authenticated ISE will put it in a respective vlan. I even have succeeded with the portal through ISE for guest users/pc. Guests connect to a port, they get redirected to guest portal for registration and then login and have only internet access. As for the portal design, Cisco provides Portal Builder isepb.cisco.com and when you're done with the design, you import it into your ISE like a boss. :D

 

This was a big project and I am happy that everything worked out as I wanted though I've grown 50 new gray hair because of this hehe. If anyone is interested on the product and wants to know how to configure dot1x, man or guest authentication I'd be happy to help, just PM me or write here.

 

My switch config:

interface GigabitEthernet1/0/22
 description GARDSHUSET RICOH AFICIO C430DN
 switchport access vlan 666
 switchport mode access
 switchport nonegotiate
 power inline never
 authentication periodic
 authentication timer reauthenticate server
 access-session control-direction in
 access-session closed
 access-session port-control auto
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 10
 spanning-tree portfast
 service-policy type control subscriber DOT1X_MAB_WEBAUTH_POLICY

 

Polic-map (class-map is also configured)

se08-as11#sh policy-map type control subscriber DOT1X_MAB_WEBAUTH_POLICY
DOT1X_MAB_WEBAUTH_POLICY
  event session-started match-all
    10 class always do-until-failure
      10 authenticate using dot1x priority 10
  event authentication-failure match-first
    5 class DOT1X_FAILED do-until-failure
      10 terminate dot1x
      20 authenticate using mab priority 20
    10 class AAA_SVR_DOWN_UNAUTHD_HOST do-until-failure
      10 clear-authenticated-data-hosts-on-port
      20 activate service-template CRITICAL_AUTH_VLAN
      30 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
      40 authorize
      50 pause reauthentication
    20 class AAA_SVR_DOWN_AUTHD_HOST do-until-failure
      10 pause reauthentication
      20 authorize
    30 class DOT1X_NO_RESP do-until-failure
      10 terminate dot1x
      20 authenticate using mab priority 20
    40 class MAB_FAILED do-until-failure
      10 terminate mab
      20 authentication-restart 60
    60 class always do-until-failure
      10 terminate dot1x
      20 terminate mab
      30 authentication-restart 60
  event agent-found match-all
    10 class always do-until-failure
      10 terminate mab
      20 authenticate using dot1x retries 2 retry-time 0 priority 10
      30 authenticate using dot1x priority 10
  event aaa-available match-all
    10 class IN_CRITICAL_VLAN do-until-failure
      10 clear-session
    20 class NOT_IN_CRITICAL_VLAN do-until-failure
      10 resume reauthentication
  event authentication-success match-all
    10 class always do-until-failure
      10 activate service-template DEFAULT_LINKSEC_POLICY_MUST_SECURE
  event violation match-all
    10 class always do-until-failure
      10 restrict
  event inactivity-timeout match-all
    10 class always do-until-failure
      10 clear-session

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Vivetool also has a GUI. Literally took me three clicks to enable this from there.
    • Microsoft Weekly: OneDrive horror stories, ramblings about Start menu, and more by Taras Buria This week's news recap is here, delivering you a roundup of the most important Microsoft stories, including a bunch of odd stuff and bugs in Windows, OneDrive horror stories, ramblings about the Start menu, a couple of new Windows 11 preview builds, important news from AMD, and a lot more. Quick links: Windows 10 and 11 Windows Insider Program Updates are available Reviews are in Gaming news Windows 11 and Windows 10 Here, we talk about everything happening around Microsoft's latest operating system in the Stable channel and preview builds: new features, removed features, controversies, bugs, interesting findings, and more. And, of course, you may find a word or two about older versions. Microsoft released a new out-of-band update to fix boot issues on certain Surface devices. The company announced certain Windows 365 updates, such as VBS and HVCI support (by default) and app provisioning in Windows 365 instead of entire cloud PCs. Microsoft is also removing legacy drivers from Windows Update in a new "strategic move." This is the default Windows 365 wallpaper On the negative side, we have the latest Patch Tuesday updates breaking the DHCP Server in all Windows Server editions. Also, there is some bad news for PC users with Windows Hello cameras: after the April 2025 Patch Tuesday updates, Windows Hello does not work in the dark. The change was quietly introduced to address security issues. Windows Goodbye That is not all, though. As it turned out, solid-state drives from WD could still block your computer from installing Windows 11 version 24H2, which was released in October 2024. Also, Microsoft's Family Safety feature is now blocking Chrome, for some reason. Here is an editorial from Usama Jawad (welcome back) about how, four years after the initial release, Windows 11 still does not offer strong enough reasons to upgrade from the outgoing Windows 10. Also, Usama shared his thoughts about the Start menu and why he had stopped caring about its changes altogether. Speaking of the Start menu, check out our overview of what users wanted from Microsoft and what the company delivered in the redesigned Start menu, which was recently announced. Windows Insider Program Here is what Microsoft released for Windows Insiders this week: Builds Canary Channel Build 27881 This week's Canary build introduced context menu improvements, new accessibility features, Settings app tweaks, and more. Dev Channel Nothing in the Dev Channel this week Beta Channel Nothing in the Beta Channel this week Release Preview Channel Build 26100.4482 (KB5060829) This build improves File Explorer and search performance, adds some changes to default browser settings, and fixes multiple bugs. Some hidden stuff in the recent Windows 11 preview builds includes a new adaptive battery saver. This feature dynamically adapts battery saver mode according to your workflow, but in its current form, it is not fully operational. Even though Microsoft acknowledged its existence, the adaptive part still needs improvements. Another useful change in the recent builds is the return of a clock in the notification center. This time, however, Microsoft makes it more customizable, and you can toggle it on or off. Also, the company is moving more Control Panel bits to the Settings app and adding a rather unexpected customization feature that will let you select where system indicators (flyouts and sliders) appear on the screen. Microsoft started rolling out a new update for the Snipping Tool app. The latest release lets you save screen recordings as GIFs. Shortly after that, we posted a guide with a bit more detail about the feature. Updates are available This section covers software, firmware, and other notable updates (released and coming soon) from Microsoft and third parties, delivering new features, security fixes, improvements, patches, and more. Microsoft is working on a Dashboard redesign for PowerToys. Developers published an early look at what is coming to the app in future updates, revealing a better-organized page with quick links, a shortcut overview, and a list of available modules. This week's Office updates are rather mixed. OneDrive, for one, is having problems finding files. Microsoft acknowledged the issue, which affects users on Windows, iOS, Android, and the web. Unfortunately, that is not the only negative story about OneDrive. A new report from a frustrated user revealed a scary tale of Microsoft locking them out of an account full of invaluable content. Outlook also has some issues, this time, with opening emails, and Microsoft 365 will soon disable outdated protocols for file access. Finally, Copilot in Excel received a major update for context awareness, which made the assistant more useful when answering questions about data. This week's browser updates include several releases. Firefox announced a new method for pinning and unpinning tabs. It is now available for testing in the Nightly channel. Microsoft Edge was updated with fixes for two security vulnerabilities (high severity) originating from Chromium. Finally, here is this week's Microsoft 365 Roadmap with an overview of all the new stuff that Microsoft added to the website. Here are other updates and releases you may find interesting: Microsoft 365 security in the spotlight after Washington Post hack. Microsoft expands European sovereign cloud offerings with new data and key controls. Microsoft Defender XDR received TITAN-powered Security Copilot recommendations. Microsoft reportedly plans more layoffs. Watchdog found Microsoft guilty of confusing advertising when it comes to Copilot. Here are the latest drivers and firmware updates released this week: AMD released a new chipset driver for Ryzen processors under version 7.06.02.123, which followed a security update for TPM-Pluton. Nvidia 576.80 WHQL with fixes for the RTX 5090 FE, new game support, and a long list of fixes. You can get some extra performance on certain AMD Ryzen chips with a simple system tweak. Surface Pro 11 and Surface Laptop 7 received big firmware updates with multiple fixes and improvements. Reviews are in Here is the hardware and software we reviewed this week This week, Steven Parker reviewed the TerraMaster D4 SSD, a palm-sized DAS with up to 32TB of storage that you can connect over USB4. This thing is rather impressive, and for a modest price tag, it delivers a tiny footprint, great looks, full RAID support in TOS 6, quick connection, and more. On the gaming side Learn about upcoming game releases, Xbox rumors, new hardware, software updates, freebies, deals, discounts, and more. AMD and Microsoft announced some big news this week. The two companies revealed a new multi-year partnership, which secures AMD as the future maker of chips for Xbox consoles and other hardware. Sarah Bond announced the partnership in a new video on the official Xbox media channels. Turn 10 Studios announced a new Forza Motorsport update. Update 21 brings IndyCar content, Career mode expansion, Featured Tours, new reward cars, and more. It is now available on Xbox and PC via the Microsoft Store and Steam. Minecraft is another Microsoft-owned game that received a big update this week. The long-anticipated graphics overhaul is finally here with directional lighting, volumetric fog, improved shadows, reflections, godrays, and a lot more. In addition, Mojang released Chase the Skies, the latest content drop, which adds happy ghasts, new music disks, a locator bar for players, environmental fog in the overworld, new background music, and all sorts of small gameplay changes. Microsoft announced new games for Game Pass. The latest additions include FBC: Firebreak, Crash Bandicoot 4: It's About Time, Start Trucker, Wildfrost, Rematch, Call of Duty: WWII, Rise of the Tomb Raider, and more. As usual, some games are leaving the subscription. Valve released a big update for the Steam overlay. The latest version introduced major upgrades to CPU and VRAM usage, temperatures, and other important metrics that you might want to track when playing games on your gaming rig. Deals and freebies Also, be sure to check out this week's Weekend PC Game Deals article, which features rhythm bundles, fishing festivals, DRM-free summer sales, and more. Other gaming news includes the following: Take-Two confirmed Borderlands 4 will not cost $80 for the base game. The Coalition expanded the Gears of War: Reloaded beta after its rocky start. Ara: History Untold 1.4 update delivered overhauls to AI, map generation, combat, and more. Star Citizen Alpha 4.2 update lands with radiation hazards, dynamic rain, and more. This link will take you to other issues of the Microsoft Weekly series. You can also support Neowin by registering a free member account or subscribing for extra member benefits, along with an ad-free tier option. Microsoft Weekly image background by steve_a_johnson on Pixabay
    • I'm afraid not, Microsoft does release updated installation images for Windows through MVS every month, but they do not include any update to Defender's components or signatures. That's what the package talked about in the article is for, it includes a PowerShell script for the update.
  • Recent Achievements

    • First Post
      Johnny Mrkvička earned a badge
      First Post
    • Week One Done
      viraltui earned a badge
      Week One Done
    • One Month Later
      serfegyed earned a badge
      One Month Later
    • Dedicated
      firey earned a badge
      Dedicated
    • Dedicated
      fettermanj earned a badge
      Dedicated
  • Popular Contributors

    1. 1
      +primortal
      635
    2. 2
      ATLien_0
      230
    3. 3
      Michael Scrip
      218
    4. 4
      Xenon
      149
    5. 5
      Steven P.
      140
  • Tell a friend

    Love Neowin? Tell a friend!