Cisco AAA/Identity/Nac :: 3750x / Dynamic VLAN Assignment For Wired Campus Network

Nov 23, 2012

I`m working on Dynamic Vlan Assigmenton the basis of end user authenticatedwhoc are part of specific AD Group in c ampus enviorment.Objective: Need to assign the vlan on switch port on the basis of authenticated users OU Group in Active Directory. Eg: There are 2 OU groups in AD, Sales and Administration. Authenticated user in Sales group should get Vlan 10 and user in Admininstration Group shoudl get Vlan 20.
 
Components:
 
Cisco 3750x/Cisco 4500
ACS Version 5.2
Microsoft AD

View 1 Replies


ADVERTISEMENT

Cisco AAA/Identity/Nac :: Use 802.1x To Authenticate Clients On Network With Dynamic VLAN Assignment From RADIUS?

Apr 11, 2013

I'm trying to use 802.1x to authenticate clients on my network with dynamic VLAN assignment from RADIUS. We have IP-Phones(powered by PoE) that only supports EAP-MD5, and we would rather use MAB(it also uses LLDP-MED for some settings) to authenticate the phones using the MAC-range from the phones vendor. The following scenario works perfect:Connect the phone and let it boot up(takes a while) and authenticate with MAB.Connect a computer in the phones data-port and let it authenticate with 802.1x(or fail and reach guest-vlan) However, the following scenario doesn't work:The computer is already connected to the phoneThe phone is then connected to the switch What happends now is that the computer is authenticated using 802.1x before the phone boots up and get's authenticated with MAB. When the phone is ready, it's authenticated with MAB and everything works. However, after a short period(let's say a minute), using `debug authentication all`, we see a "NEW LL MAC: phones mac" message(which is weird since the mac has already been MAB-authenticated), and then we are unable to contact the phone using ping. When I check `show mac address-table` it has now moved the mac from `Port Gi 0/12` to `Port Drop`. However, if I check `show mab interface Gi 0/12` or `show authentication sessions` it lists the phones-mac as `mab auth sucess `.why the first scenario works, and not the second?
 
The switch is a 3560E PoE 24p with IOS 12.2.58SE2. Sample of the switch-config: network-policy profile 1voice vlan 90!interface GigabitEthernet0/12switchport mode accessnetwork-policy 1authentication control-direction inauthentication event fail retry 1 action authorize vlan 60authentication event server dead action authorize vlan 60authentication event no-response action authorize vlan 60authentication event server alive action reinitializeauthentication host-mode multi-domainauthentication order mab dot1xauthentication priority mab dot1xauthentication port-control autoauthentication periodicauthentication violation replacemabdot1x pae authenticatordot1x timeout tx-period 5dot1x max-reauth-req 1spanning-tree portfast!Btw, when we tried authenticating the phones using 802.1x too (EAP-MD5), there are NO problems in any of the scenarios. However, we want to use MAB instead of 802.1x to avoid the requirement of configuring the phones with a username and password. The RADIUS response was the same when using 802.1x as it is with MAB for the phones (including device-traffic-class=voice AV-pair).

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ACS4.1 - Radius Dynamic VLAN Assignment Not Working?

Jan 28, 2013

When the users connect their laptop they are getting a authentication prompt but the switch is not changing the VLANs on the port after successful authentication.Below are the logs on the switch 
 
Jan 28 2013 17:21:32.417 CST: RADIUS:  Framed-MTU          [12]  6   1500
Jan 28 2013 17:21:32.417 CST: RADIUS:  Called-Station-Id   [30]  19  "E4-D3-F1-0B-C6-0A"
Jan 28 2013 17:21:32.417 CST: RADIUS:  Calling-Station-Id  [31]  19  "84-8F-69-A8-BD-1D"
Jan 28 2013 17:21:32.417 CST: RADIUS:  EAP-Message         [79]  45

[code]....

View 1 Replies View Related

Cisco :: WLC 4.0 - Dynamic VLAN Assignment And DHCP

Jan 16, 2011

I have just upgraded our WLC from 4.0 to 7.0 (via 4.2). Before the upgrade we had our ACS returning a VLAN based on user group.  This seemed to be working without an issue.  Now that the WLC is on version 7 this is no longer working correctly.  The ACS is returning a VLAN and passing the user but the client can not get an IP from the DHCP server configured.
 
Example configuration:
 
SSID-----VLAN
 
PN-CSC-----CSCVlan: Works
PN-Others------OthersVlan: Works
 
PN-Others-----CSCVlan: No DHCP
 
When users are trying to be allocated to a vlan that is different from the native one the DHCP fails however both WLANs are configured to point to the management interface so dont have any real connection to the vlan other than by name.
 
Have there been any changes I haven't seen in the way the dynamic vlan allocation works in version 7?

View 8 Replies View Related

Cisco :: Dynamic Vlan Assignment With 1242AG And IAS Not Working

Dec 13, 2012

I'm having trouble getting the dynamic vlan assignment to work on my 1242AG Cisco Aironet APs. I've seen multiple cases with a similar setup and configuration where it works just fine.  I've tried everything I can think of. IAS and AD is running on Windows Server 2003.Everything works fine except the vlan assignment.  Wireless clients successfully authenticate through IAS and Active Directory, but instead of being switched to the appropriate vlan the client stays in whichever vlan/ssid it originally connected to.PEAP is the authentication method, using MS-CHAP v2.  Naturally I have the attributes in the policy set appropriately,[code] I've attached the config for the AP, which shows that I have two vlans/SSIDs set to cipher, aes, network eap, wpa, etc. I noticed that if the Tunnel-Pvt-Group-ID attribute is set to a vlan id that doesn't exist on the AP then the AP makes an event log saying so.

View 16 Replies View Related

Cisco Wireless :: WAP4410N 802.1x Dynamic VLAN Assignment?

Nov 27, 2012

Does the WAP4410N support Dynamic VLAN assignment by means of 802.1x authentication?
 
The reason why I ask this; I am able to configure a SSID on a WAP4410N with WPA2-Enterprise, in combination with 802.1x PEAP network authentication. I can succesfully connect Windows, Windows RT, Windows Phone, iOS and Android devices. But.. I am unable to designate them to another VLAN based on access/connection policies. For example; I want mobile devices such as iPhone and Windows Phone to be assigned to a specific VLAN. The Wireless Access Point (authenticator) must be able to support that.
 
This is my setup:
 
Spplicants: Windows 8 / iPad / ...
Authenticator: WAP4410N
Authentication Server: Microsoft NPS (Network Policy Server)
 
I used 802.1x PEAP (Protected EAP) with password (domain user) authentication. In fact, the suplicants communicate with 802.1x to the authenticator. The authenticator communicates with RADIUS to the authentication server. NAP is not in between. It's just plain 802.1x authentication.
 
wether dynamic VLAN assignment is supported?

View 5 Replies View Related

Cisco Switches :: Dynamic VLAN Assignment And Layer 3 Switching On 300 Series?

Jul 11, 2012

I have a SG300-28P switch. I just read in the Administration Guide that, when in Layer 3 mode, the switch doesn't support MAC-based VLAN or Dynamic VLAN Assignment.
 
So, in order to assign a client to a VLAN based on their MAC or based on the response of a RADIUS server, we have to disable layer 3 features. Without layer 3 switching, the switch is unable to act as a default gateway and forward packets between VLANs. As a result, the VLANs can't communicate in any way, or access the internet, unless a separate router is connected to every VLAN. Right? Doesn't this limitation significantly reduce the usefulness of the DVA feature?

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ISE - WLC 7.2 VLAN Assignment?

Sep 10, 2012

The Wireless_Employees authorization profile,assign vlan 666 for wireless employees.ISE is passing VLAN 666 to the WLC - see attachement Radius Auth-VLAN666.jpg then I look on the WLC at a wireless employee who has successuflly connected to the network, WLC is still placing him in the pre-configured VLAN 7.

1. can VLAN be pushed from ISE to the WLC (code 7.2.103) for specific user session?

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Guest Vlan - Assignment Error On 3560 Switch?

May 18, 2013

I am configuring 802.1X in a 3560 Switch, my Radius server is a Microsoft IAS, when I connect a station of a guest user, the guest-vlan is not assigned in the port, and I have these logs:
 
May  8 21:23:02: dot1x-ev:Received an EAP Timeout on FastEthernet0/8 for mac 0000.0000.0000
May  8 21:23:02: dot1x-ev:dot1x_guest_vlan_applicable: Guest VLAN not

[Code].....

View 7 Replies View Related

Cisco VPN :: ASA 8.2 - ACS 5.2 With Dynamic VPN IP Pool Assignment?

Aug 7, 2011

I have Remote Access VPN users (IPsec) who  are terminated on Cisco ASA 5520 (v8.2). For those users, AAA is done on the ACS.  Group-policies and tunnel groups are defined on ASA. Initialy I had all  VPN users defined on ASA and group policies were associated with each  user. Each group policy had it’s own IP pool for users. Now, I moved  users to ACS. How can I associate group policy, defined on ASA, with  users group defined on ACS? Is it possible that ACS send to ASA  information about IP pool for different group policy? Users will use ONE vpn profile BUT based on the Active Directory group they belong to they obtain a different IP address for each group.Can it be done ? ACS version is 5.2.

View 1 Replies View Related

Cisco :: WLC5500 - Disable Dynamic Channel Assignment (DCA) For Group

Jan 6, 2013

Is it possible to disable DCA for a couple of APs and manually force the channels assignment ?

View 3 Replies View Related

Cisco Wireless :: VLAN Assignment Without ACS On 5508

Apr 8, 2013

I was wondering if it is possible to do dynamic VLAN assignment on the Cisco Wireless Controller 5508 without using Cisco ACS but use Microsoft NPS server instead?

View 3 Replies View Related

Cisco Firewall :: ASA5520 / How To Use Network Object NAT To Perform Regular Dynamic PAT And Identity NAT

Jun 19, 2011

this is ASA5520 associate with 8.4(1). very simple scenario , three ports: inside . outside . DMZ my problem is how to use network object NAT to perform Regular Dynamic PAT and Identity NAT.

for example, this is my configuration

**** first i configured Regular Dynamic PAT****
 
object network myinside
subnet 10.200.11.0 255.255.255.0
nat (inside,outside) dynamic interface 
**** then , i met problem when i want to make identity NAT between inside and DMZ****
**** if i add below CLI , the first nat line will be replaced ****
**** SO IF I ADD THIS****

[code]......

View 4 Replies View Related

Cisco AAA/Identity/Nac :: Secure ACS 5 For IP Address Assignment Via RADIUS?

Jan 13, 2013

I want to use RADIUS (of Secure ACS 5.3) to authenticate users within an ISP environment. Users log connect to a network using a point to point connection (L2) and then they are sending a RADIUS request to get IP adresses. Secure ACS is not quite easy to look through in that case.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.1 Device Admin Privilege Assignment?

Dec 1, 2011

my admin user is still being assigned privilege level 1, as shown in AAA Protocol > TACACS+ Authentication Details report.The report seems to show that the user is getting the right shell profile (Selected Shell Profile: Net-Admin -- is the one I setup for this user's group with both Default Privilege and Maximum Privilege set to Static 15). But still not the right privilege (Privilege Level: 1).Also, I found this document via Google: [URL] The router configuration examples all show this "aaa authorization exec tacacs+|radius local" command, which my device does not have.So I am wondering if I am not reading the ACS report right, or the device actually was assigned the correct privilge but that does not work without the "aaa authorization exec" command in the configuration?

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 Static IP Assignment For Local User

Jun 7, 2011

how I can assign a static IP to a user in ACS 5.2. I am able to do it in ACS 4.2, but I don't see the same options under 5.2. General idea is that users authenticate from our VPN appliance via RADIUS, and upon authentication, their static IP is passed back to the VPN device. I can attach an arbitrary field to my local users by going to System Administration -> Configuration -> Dictionaries -> Identity -> Internal Users, but how do I get that IP address passed back when the user is authenticated via Radius?

View 1 Replies View Related

High Speed Campus Network

May 10, 2012

What ways can i connect the two building networks together(i.e best tools to use) supposing each building has a router. How will i make computer no. 10 accessible by all computers in the network.

View 1 Replies View Related

Implementing InterVLAN Routing In Campus Network?

Dec 9, 2012

I have a task to compare different approaches to implement InterVLAN routing in campus network. Google suggests only Cisco technologies for such query. But what I need is also other companies solutions (like Dell, HP etc), cost of the implementations, pros and cons.

View 1 Replies View Related

Cisco WAN :: 3845 - Connecting Branch Campus To Existing Network

Oct 2, 2011

In regards to a WAN connection, how would you recommend we connect a leased campus to our existing network. It is a temporary location that must be connected for a year.
 
We have an available 3845 with a VWIC2-2MFT-T1/E1 card. We are supposed to be getting 2-T1 lines from Verizon. I have a spare 3750 L3 switch for the core and 6 access switches.

View 1 Replies View Related

Home Network :: Unable To Ping Static Ip From Outside Campus

Nov 7, 2012

I have 5 Static Ip pool all IPs are working fine. I have deploy a IIS Server on Windows2008 and configure the Static IP on that server. earlier it was working fine . but since last month the IP is not pinging from Out Side but internal IP Pool its working. I have checked the SERver firewall and another Setting is Ok. if i changed the Ip from the server the new IP is also not pinging.

View 1 Replies View Related

How To Setup Wifi Network In Large Campus Building

Apr 26, 2011

How to setup a WIFI Network in a large campus building.

View 5 Replies View Related

Cisco :: 1130 AG - MBSSID And Dynamic Vlan

Jun 26, 2011

I have some 1130AG access point and I'd like to have :

- Multiple broadcasted SSIDs (because most of my clients are OSX and OSX doesn't deal with hidden SSID at all ! the clients have to enter the data each time which for WPA2 enterprise is really annoying)
- Dynamic VLAN assignement (so my clients don't have to know to which VLAN they belong and so I can easily change them from one to another).
 
As it turns out, it's apparently not supported to have both. But I can't understand WHY ? What exactly is the relation between those features ? What's the underlying technical constraint ?

I can understand the cipher suite must match between all the dynamic vlan because of the way wlan works, but for this, I really don't see what the problem is ... (Especially since I only have one of the SSID that needs dynamic assignement, the other is really the 'guest' one).

View 4 Replies View Related

Cisco :: Fictional Network Design Assignment

Mar 5, 2013

I have gotten the assignment of constructing a fictional network for my school.. and i cannot quite agree with myself upon which equipment i should choose.. its supposed to be all cisco. i need to supply 5000 users all in all, but only 300 on this site. i need to know which connections would be the most reasonable to use and of course which routers "if any" and switches i need.. (+ additional modules if needed) i have tried to make a visio representation, but i just think something is way off.

View 6 Replies View Related

Cisco Switches :: SG300-28 - Dynamic VLAN And Free Radius Log

Aug 21, 2012

I am using several SG300-28 Switches with firmware version 1.1.2.0.I have dynamic VLAN enabled. As RADIUS server I am using free radius 2.1.12.Authentication is only based on the MAC address. (I configured that on the switches)On the switches I created three VLANs. VLAN100 for the authenticated clients, VLAN200 for Management interface and VLAN300 as Guest VLAN. After a wrong authentication the clients should be put into this Guest VLAN immediately (I configured this on the switches). I am using Windows XP and Windows 7 clients in my network. I did not configure any EAP settings because I just wnat to use the MAC address. 

In most cases the dynamic VLAN assignment and authentication is working fine. The switch log says that the client is authenticated and the same I can see on free radius log. But in some (rare) cases the client is rejected. The CISCO log says "MAC aa:bb:cc:dd:ee:ff was rejected on port ge17" but when I look at the free radius log then this MAC address was successfully authorized.
 
The problem is that the client gets an IP address based on the Guest VLAN300 but after that the switch seems to "switch" the VLAN on the port and then the client is authenticated correctly on the right VLAN but the client does not request a new IP on the new VLAN. If I unplug and re-plug the LAN cable in most cases the client get the correct VLAN and the correct IP. This is happening randomly on nearly all my PCs.
 
Do I have to set some timers higher ? I don't think it is a problem between switch and RADIUS but a problem between communication of the host and the switch.

View 14 Replies View Related

Cisco AAA/Identity/Nac :: 802.1x Auth-Fail VLAN And Guest-VLan Not Available

Oct 12, 2011

I'm wanting to setup a Virtual Office scenario. Everything is working fine except for 802.1x...I can get the 881 to authenticate things connected to it, but I don't have the options of guest-vlan or auth-fail vlan.Idea is if the users takes the router home and someone, either accidentally or on pupose, connects an unauthorized Laptop, they stay off the Corp network but can get to the internet still.I found this link on Cisco's site: [URL]That link shows them configuring a guest vlan right on the fa0-3 ports of an 881W. I dont have that option on mine. I can only configure 802.1x on the vlan interface. I have 802.1x working, for things that connect to vlan1, but I would like to have a "fallback" setup.
 
EZVPN_Remote(config-if)#int fa1
EZVPN_Remote(config-if)#dot
EZVPN_Remote(config-if)#dot1?
dot1q 
EZVPN_Remote(config-if)#dot1

[code]....

View 1 Replies View Related

Cisco LAN :: 3750x Best Way To Completely Segregate One VLAN?

Jan 25, 2013

I have 3750x with existing small business server and all computers on one vlan. This vlan connects to other switches with fibre trunk sfp's.I want build a new forest utilising vlans in the normal way, what is the easiest way to segregate this vlan?The site is running 24/7.

View 6 Replies View Related

Cisco WAN :: 3750x - Internet Is Working Only On VLAN 1

May 23, 2013

I  need to connect two switches with each have different Vlans and wants  to Connect the users of These Switches to Existing Network of  Company(Vlan 1 ; showing Right in the picture).
 
I  have created Vlans and able to route packets from Two Vlans (10,20) to  VLAN 1 but i am unable to get access to Users existing in vlan 10,20.
 
Internet  is working fine from VLAN1 and existing network did not have any router  ,it is just a DSL modem and did not have Static /Default Route  option,NAT.
 
What Option should i choose for it. 3750x have 12 Mini Gbic Slots and 1 Routed port and did not have any NAT options in it.

View 1 Replies View Related

Cisco Switching/Routing :: Dynamic ARP 3560 Inspection On Single Vlan

Apr 22, 2013

I have enabled IP DHCP snooping on a 24 port 3560 switch (v small office) and let the database fill up, now I have added dynamic arp inspection on the single vlan and I amd getting these errors. 

Apr 23 16:15:34: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Fa0/5, vlan 1.([5835.d9b0.b9d1/172.30.5.2/0000.0000.0000/172.30.5.3/16:15:33 BST Tue Apr 23 2013])
Apr 23 16:15:39: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Fa0/8, vlan 1.([0004.f2be.55e4/172.30.5.5/0000.0000.0000/172.30.5.8/16:15:39 BST Tue Apr 23 2013])
Apr 23 16:15:40: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Fa0/8, vlan 1.([0004.f2be.55e4/172.30.5.5/0000.0000.0000/172.30.5.8/16:15:40 BST Tue Apr 23 2013])
[Code] .....

View 2 Replies View Related

Cisco Switching/Routing :: VLAN Flapping In 3750x

Sep 22, 2011

I recently upgraded my network to have two 3750x core, one interface on the cisco is connecting to a Netgear switch via a fiber converter. I am keep getting the vlan flapping error message in my log as below.

View 2 Replies View Related

Cisco WAN :: 3750X Metro Ethernet And VLAN Configuration

Apr 7, 2013

I am trying to configure a new metro ethernet and have some questions about the configuration. The physical layout is a main office and two remote locations. The remote sites are point-to-point connections to the main office, tagged by the ISP with VLAN 130 and VLAN 140. The connections aggregate into one handoff at the main office, and are plugged into Catalyst 3750-X switches at all three sites.

View 8 Replies View Related

Cisco WAN :: 3750X - Print Servers On New VLan Configuration

Mar 26, 2012

Company has implemented a 3750x with older Lexmark Pro print servers on new V lan configuration for printers.  Causing print servers to lose connection.  Have to reset constantly.  Have tried to configure print server ports to full.  Also new Nexus 7000.  Perfect scenario is network devices.. not there yet. 

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Dynamic ACLs On 2960S Switch Using ACS 5.2

Apr 20, 2011

I am testing a ACS 5.2 in our lab environment, I am testing port security for policy based VLAN and ACL assignment. The problem I am having is with the 2960S switches; in my current setup it is working but it doesn't seem to me like it is the way that it should be working. I have a downloadable ACL in the ACS defined and associated to an Access policy and it is working correctly. The problem is, from what I understand, I have to assign a default ACL on the switchport? So what I have assigned on the switchport is ip access-group 10 in. The downloadable ACL from the ACS is also called 10. Do I really need to match the ACL on the switchport with the ACL name I have created in ACS? That doesn't seem like it's dynamic if that is the case? What is the ACL that I should apply to the switch port (if any) in order for the downloadable acls that I configure in the ACS to work no matter what port the user is patched into?

View 2 Replies View Related

Cisco AAA/Identity/Nac :: 002SWC003 - ISE Dynamic Authorization Failed

Dec 5, 2012

I am gettning warning messages in ISE saying

Cause:Dynamic Authorization Failed for Device: 0002SWC003 (switch)Details:Dynamic Authorization Failed 
 
It is not only on that switch but on all switches I have configured. I am using 3560 IPBase 12.2(55)SE6. I have configured them according to Trustsec 2.1. My end devices are none-802.1x. I can't figure out what is causing this error.
 
The thing is that I have not experienced any problem. In Live Authentications there are some 'Unknown' and 'Profiled' devices hitting the DenyAccess rule, but other then that everying is beeing Authorized fine.

View 8 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved