Recommended Posts

Is it possible for a radius server to assign vlan dynamically on a switch port that is on a dummy vlan before it gets authenticated?

 

What I mean if a domain PC connects to a switch port assign vlan 3180 - 3189 (these are client vlans), if it is a printer assign it to vlan 3017 and if it is a guest user assign it to vlan guest and send it to a web portal for registration. Is this even possible or I am thinking way out of the box?

Link to comment
https://www.neowin.net/forum/topic/1354172-dynamic-vlan-assignment-with-radius/
Share on other sites

There are many ways to assign vlan based upon criteria - mac, auth to radius sure.. What switch(es) do you have?  Your 30$ smart switch not going to be able to do this sort of thing ;)

 

Sounds like your wanting to implement a NAC... Check out https://packetfence.org/

 

If your a cisco shop it would be ICE.. But not free ;)  https://www.cisco.com/c/en/us/products/security/identity-services-engine/index.html

Great, then what I am trying to do will work somehow. Haha, my switch cost almost 1000$ :p

 

I am going to use ISE and what I want to do is: Dot1X and MAB, but if the user is not found in the AD or ISE DB should be redirected to a guest web portal for registration. Now if when I assign the port to a specific vlan for dot1x it works fine, i.e client vlan, but it will not change vlan to guest vlan after the registration is done.

 

So now I want to assign all ports to a dummy vlan i.e 999 and after switch port is authenticated for domain pc's it should move them to client vlan and the same for printer vlan. Guest should be moved from dummy vlan to guest vlan after the registration is done.

This is a common setup where device gets dumped into restricted vlan until they auth in some manner, fill out info in a captive portal could sure be one of those options.

 

I am quite sure ISE can do that... I would open up a tac case with cisco if your having problem with specific configuration option not working etc,

Good to know it is possible, have you done this before?

Yeah, I am sure ISE can do it. The problem is that ISE 2.3 they have re-done everything and there aren't a lot of documentation so read and the older ones aren't really applicable.

 

I will open a tac case, but wanted to make sure that it is possible from radius perspective.

Sure when I get to work in the morning I will post up some info..

 

Got called so a bit early this morning.. Freaking circuit can not stay up for more 30 days at a time without a freaking issue... Arrrggh ;)

  On 23/01/2018 at 22:27, nabz0r said:

Is it possible for a radius server to assign vlan dynamically on a switch port that is on a dummy vlan before it gets authenticated?

 

What I mean if a domain PC connects to a switch port assign vlan 3180 - 3189 (these are client vlans), if it is a printer assign it to vlan 3017 and if it is a guest user assign it to vlan guest and send it to a web portal for registration. Is this even possible or I am thinking way out of the box?

Expand  

 

 

Here is what happens in my scenario.

Vlan 1 is an unconfigured vlan.  Vlan1 is essentially shut down. 

If an unauthenticated computer/device somehow holds the port open, that computer/device resides on vlan1.  Vlan1 has no IP or subnet, it routes no where.  Most of the time, if a computer can't auth the port goes into an administrative shutdown state.  If I plug my fluke LinkRunner in, it holds the port in an online status and it gives me the port info and the configured vlan of 1.

 

If a computer gets authenticated, Radius then pushes out what vlan that port can communicate on.

 

I think that is the scenario that you are looking for...a dummy vlan (The default vlan of the switch, which should always remain unconfigured).

 

802.1x doesn't really support a "portal".  You can configure the switch to use the default vlan for all else to belong to a vlan that has portal access (your default vlan for the access port)....

 

in my switch I would do this as an example:

int gi1/0/1

switchport mode access

switchport access vlan 3017

authentication order

authentication port control auto

mab

dot1x pae authenticator

spanning-tree portfast edge

 

This would put all unauthenticated computers on vlan 3017

 

It kind of urks me a little that the 2960x series has a different state of cli instructions, how the x series has depreciated commands where the xr series they continue to live and breathe in.

For you, you may want to look at this and look at the guest vlan settings or 802.1x Authentication with Restricted VLAN:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_010000.html#ID737

 

@BudMan, I actually have seen that link and he uses NPS, not ISE. I have figured it out and my ISE is now doing all the job with a little help of Ative directory and I am going to use ISE for authentication and command authorization based on AD group for network department, today we're using local username which is NO good.

 

@sc302, Yes, that is the scenario I was looking for. All switch ports are assigned a dummy vlan, though not vlan 1 and when a device gets authenticated ISE will put it in a respective vlan. I even have succeeded with the portal through ISE for guest users/pc. Guests connect to a port, they get redirected to guest portal for registration and then login and have only internet access. As for the portal design, Cisco provides Portal Builder isepb.cisco.com and when you're done with the design, you import it into your ISE like a boss. :D

 

This was a big project and I am happy that everything worked out as I wanted though I've grown 50 new gray hair because of this hehe. If anyone is interested on the product and wants to know how to configure dot1x, man or guest authentication I'd be happy to help, just PM me or write here.

 

My switch config:

interface GigabitEthernet1/0/22
 description GARDSHUSET RICOH AFICIO C430DN
 switchport access vlan 666
 switchport mode access
 switchport nonegotiate
 power inline never
 authentication periodic
 authentication timer reauthenticate server
 access-session control-direction in
 access-session closed
 access-session port-control auto
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 10
 spanning-tree portfast
 service-policy type control subscriber DOT1X_MAB_WEBAUTH_POLICY

 

Polic-map (class-map is also configured)

se08-as11#sh policy-map type control subscriber DOT1X_MAB_WEBAUTH_POLICY
DOT1X_MAB_WEBAUTH_POLICY
  event session-started match-all
    10 class always do-until-failure
      10 authenticate using dot1x priority 10
  event authentication-failure match-first
    5 class DOT1X_FAILED do-until-failure
      10 terminate dot1x
      20 authenticate using mab priority 20
    10 class AAA_SVR_DOWN_UNAUTHD_HOST do-until-failure
      10 clear-authenticated-data-hosts-on-port
      20 activate service-template CRITICAL_AUTH_VLAN
      30 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
      40 authorize
      50 pause reauthentication
    20 class AAA_SVR_DOWN_AUTHD_HOST do-until-failure
      10 pause reauthentication
      20 authorize
    30 class DOT1X_NO_RESP do-until-failure
      10 terminate dot1x
      20 authenticate using mab priority 20
    40 class MAB_FAILED do-until-failure
      10 terminate mab
      20 authentication-restart 60
    60 class always do-until-failure
      10 terminate dot1x
      20 terminate mab
      30 authentication-restart 60
  event agent-found match-all
    10 class always do-until-failure
      10 terminate mab
      20 authenticate using dot1x retries 2 retry-time 0 priority 10
      30 authenticate using dot1x priority 10
  event aaa-available match-all
    10 class IN_CRITICAL_VLAN do-until-failure
      10 clear-session
    20 class NOT_IN_CRITICAL_VLAN do-until-failure
      10 resume reauthentication
  event authentication-success match-all
    10 class always do-until-failure
      10 activate service-template DEFAULT_LINKSEC_POLICY_MUST_SECURE
  event violation match-all
    10 class always do-until-failure
      10 restrict
  event inactivity-timeout match-all
    10 class always do-until-failure
      10 clear-session

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Is this for Black people only? You'd definitely think so from the ad.
    • I have it as an icon in the Start Menu. Close enough for when I need it.
    • Windows 11 Pro with a copy of Office 2021 Pro drops to all-time low price by Steven Parker Today's highlighted deal comes via our Apps + Software section of the Neowin Deals store, where you can save 86% on Windows 11 Pro (for 2 devices) + Microsoft Office Pro 2021. Upgrade your computing experience with Windows 11 Pro. This cutting-edge operating system boasts a sleek new design and advanced tools to help you work faster and smarter. From creative projects to gaming and beyond, Windows 11 delivers the power and flexibility you need to achieve your goals. With a focus on productivity, the new features are easy to learn and use, enhancing your workflow and efficiency. Whether you're a student, professional, gamer, or creative, Windows 11 Home has everything you need to take your productivity to the next level. New interface. easier on the eyes & easier to use Biometrics login*.Encrypted authentication & advanced antivirus defenses DirectX 12 Ultimate. Play the latest games with graphics that rival reality. DirectX 12 Ultimate comes ready to maximize your hardware* Screen space. Snap layouts, desktops & seamless redocking Widgets. Stay up-to-date with the content you love & the new you care about Microsoft Teams. Stay in touch with friends and family with Microsoft Teams, which can be seamlessly integrated into your taskbar** Wake & lock. Automatically wake up when you approach and lock when you leave Smart App Control. Provides a layer of security by only permitting apps with good reputations to be installed Windows Studio Effects. Designed with Background Blur, Eye Contact, Voice Focus, & Automatic Framing Touchscreen. For a true mouse-less or keyboard-less experience TPM 2.0. Helps prevent unwanted tampering Windows 11 Pro also includes a number of productivity-focused features, such as the ability to snap multiple windows together and create custom layouts, improved voice typing, and a new, more powerful search experience. Personal and professional users will enjoy a modern and secure computing experience, with improved performance and productivity features to help users get more done. Only on Windows 11 Pro If you require enterprise-oriented features for your daily professional tasks, then Windows 11 Pro is a better option. Set up with a local account (only when set up for work or school) Join Active Directory/Azure AD Hyper-V Windows Sandbox Microsoft Remote Desktop BitLocker device encryption Windows Information Protection Mobile device management (MDM) Group Policy Enterprise State Roaming with Azure Assigned Access Dynamic Provisioning Windows Update for Business Kiosk mode Maximum RAM: 2TB Maximum no. of CPUs: 2 Maximum no. of CPU cores: 128 Good to know: Length of access: lifetime Redemption deadline: redeem your code within 30 days of purchase Access options: desktop Max number of device(s): 2 (Use one activation key for up to 2 devices) Version: Windows 11 Pro Updates included Click here to verify Microsoft partnership For Windows 10 or Newer! Get All Essential Microsoft Apps for Your PC with This One-Time Purchase This is intended for families and small businesses who want classic Office apps and email. It includes Word, Excel, PowerPoint, Outlook, Teams, and OneNote. A one-time purchase installed on 1 Windows PC for use at home or work. Lifetime license for MS Word, Excel, PowerPoint, Outlook, Teams, & OneNote One-time purchase installed on 1 Windows PC for use at home or work Instant Delivery & Download – access your software license keys and download links instantly Free customer service – only the best support! Microsoft Office Professional 2021 (for Windows) includes: Microsoft Office Word Microsoft Office Excel Microsoft Office PowerPoint Microsoft Office Outlook Microsoft Office Teams Microsoft Office OneNote Microsoft Office Publisher Microsoft Office Access Good to know: ONE-TIME PURCHASE INSTALLED ON 1 DEVICE Redemption deadline: redeem your code within 30 days of purchase Access options: desktop Full versions No subscriptions – no monthly/annual fees Version: 2021 Updates included Here's the deal: This Microsoft Office Pro 2021 + Windows 11 Pro normally costs $438, but this deal can be yours from just $54.97, that's a saving of $383. For full terms, specifications, and license info please click the link below. Use MSO5 when checking out for additional $5 off. Coupon Expires June 29. Get Microsoft Office Pro 2021 + Windows 11 Pro for just $49.97, or learn more Although priced in U.S. dollars, this deal is available for digital purchase worldwide. We post these because we earn commission on each sale so as not to rely solely on advertising, which many of our readers block. It all helps toward paying staff reporters, servers and hosting costs. Other ways to support Neowin Whitelist Neowin by not blocking our ads Create a free member account to see fewer ads Make a donation to support our day to day running costs Subscribe to Neowin - for $14 a year, or $28 a year for an ad-free experience Disclosure: Neowin benefits from revenue of each sale made through our branded deals site powered by StackCommerce.
    • I'm not a fan of the HP "Smart" app either, but it does work. I just wish I didn't have to log in to use it. HP Color LaserJet Pro MFP 4301
    • FocusOn Image Viewer 1.32 by Razvan Serea FocusOn Image Viewer is a fast, lightweight, and user-friendly photo viewer for Windows. It supports various image formats, offers basic editing tools, EXIF data display, and batch renaming. With a clean interface, slideshow mode, and easy navigation, it’s ideal for quickly viewing and organizing photos without unnecessary complexity or system resource usage. FocusOn Image Viewer key features: Auto Organize: Automatically sorts photos by date using your chosen template. Explorer View: Browse and manage images with thumbnails; includes basic edits like resize and rotate. Photo Editing: Crop, apply filters, correct colors, add borders or text. Non-Destructive Edits: Original images remain untouched. Photo Sharing: Post directly to blogs, Twitter, and Facebook. Email Support: Send selected images via email. Print Options: Print to fit paper size, preserve aspect ratio, or fit multiple images per page. Slideshow: View selected photos in a slideshow. EXIF Tools: View or remove EXIF data. Scanning: Import from TWAIN or WIA-compatible scanners. Set as Background: Quickly set any image as desktop wallpaper. Batch Rename: Rename images in bulk using templates. Resize Images: Resize with optimized or custom resampling methods, including multi-step resizing. Thumbnail Sizes: Choose from thumbnail sizes between 32–256 pixels. Format Support: Compatible with over 100 image formats. FocusOn Image Viewer 1.32 changelog: Added Ghostscript(AI, PDF) DPI option Fixed transparency issue when saving PDF document as image Other improvements and bug fixes Download: FocusOn Image Viewer 64-bit | Portable 64-bit | ~7.0 MB (Freeware) Download: FocusOn Image Viewer 32-bit | Portable 32-bit View: FocusOn Image Viewer Website | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
  • Recent Achievements

    • First Post
      Johnny Mrkvička earned a badge
      First Post
    • Week One Done
      viraltui earned a badge
      Week One Done
    • One Month Later
      serfegyed earned a badge
      One Month Later
    • Dedicated
      firey earned a badge
      Dedicated
    • Dedicated
      fettermanj earned a badge
      Dedicated
  • Popular Contributors

    1. 1
      +primortal
      654
    2. 2
      Michael Scrip
      224
    3. 3
      ATLien_0
      223
    4. 4
      Xenon
      147
    5. 5
      +FloatingFatMan
      144
  • Tell a friend

    Love Neowin? Tell a friend!