Dynamic Vlan assigment 802.1x with cisco
Hi, I have a problem to change vlan on a Catalyst 2950 switch using the 802.1x protocol. The problem is that no changes to the vlan you specified. The authentication and validation of the user is correct, but does not change vlan. Freeradius User Configuration: steve Cleartext-Password := "testing" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 2 Switch 2950 configuration: aaa new-model aaa authentication login default local aaa authentication dot1x default group radius enable secret 5 $1$Hpyf$/AA8F3lVYES7KUq0abTqy. interface FastEthernet0/3 switchport mode access no ip address dot1x port-control auto interface Vlan1 ip address 192.168.250.250 255.255.255.0 no ip route-cache ip http server ip radius source-interface FastEthernet0/2 radius-server host 192.168.250.200 auth-port 1812 acct-port 1813 key password radius-server retransmit 3 no radius-server attribute nas-port privilege exec level 0 line show Right now, this created the vlan 1 and vlan 2 Thanks.Guillermo _________________________________________________________________ ¡Citas! ¡Ligues! ¿Salimos? ¿Cómo es tu pareja ideal? Búscala en el sitio nº1… ¡Regístrate ya! http://contactos.es.msn.com/?mtcmk=015352
Guillermo Borrallo <guillebs89@hotmail.com> wrote:
I have a problem to change vlan on a Catalyst 2950 switch using the 802.1x protocol. The problem is that no changes to the vlan you specified. The authentication and validation of the user is correct, but does not change vlan.
You might want to consider reading the *Cisco* documentation...on the...erm...*Cisco* website rather than posting on the FreeRADIUS mailing list about problems you are having with your...erm...*Cisco* equipment? Unsurprisingly this is where *FreeRADIUS* problems are solved...not $OTHER_VENDUH issues. I could also argue that this information is lurking in the FreeRADIUS wiki: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO#Con...
Freeradius User Configuration:
steve Cleartext-Password := "testing" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 2
I have no idea why people keep insisting on doing this, but make 'Tunnel-Private-Group-ID' the VLAN *name*. You are only going to end up killing yourself later on if you insist on using VLAN ID's. You should also type: ---- vlan 1 name cheese vlan 2 name toast ---- Then you can use 'cheese' and 'toast' to put people into VLAN's instead; handy if you have to send this information across administrative domains.
Switch 2950 configuration: aaa new-model aaa authentication login default local aaa authentication dot1x default group radius
*sigh* For those who cannot be bothered to read the readily, freely, non-login protected available documentation[1]: ---- aaa authorization network default group radius aaa accounting dot1x default start-stop group radius ---- If that does not work, I cannot be bothered to check the rest of your (incomplete) config so I recommend you read the...erm...documentation. Regards [1] http://www.cisco.com/en/US/products/hw/switches/ps628/tsd_products_support_s... and more specifically http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/1... -- Alexander Clouter .sigmonster says: Do not use if foil seal is broken.
Hi,
steve Cleartext-Password := "testing" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 2
I have no idea why people keep insisting on doing this, but make 'Tunnel-Private-Group-ID' the VLAN *name*. You are only going to end up killing yourself later on if you insist on using VLAN ID's.
because their kit will only work with VLAN assignment being numbers and not names? ;-) alan
Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
steve Cleartext-Password := "testing" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 2
I have no idea why people keep insisting on doing this, but make 'Tunnel-Private-Group-ID' the VLAN *name*. You are only going to end up killing yourself later on if you insist on using VLAN ID's.
because their kit will only work with VLAN assignment being numbers and not names? ;-)
The old Aironet 1130/1200's AP's needed numbers I remember but I am pretty sure that an IOS update fixed that. However, now with our infernal WLC4400 and the C3750's we have I am using names and have been for three years. My counterpart in some multinational is on their 29[56]0's and I am pretty sure three/four years ago when started playing with 802.1X the 2950 I was playing with did permit the use of names. Cheers -- Alexander Clouter .sigmonster says: Neckties strangle clear thinking. -- Lin Yutang
Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
steve Cleartext-Password := "testing" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 2
I have no idea why people keep insisting on doing this, but make 'Tunnel-Private-Group-ID' the VLAN *name*. You are only going to end up killing yourself later on if you insist on using VLAN ID's.
because their kit will only work with VLAN assignment being numbers and not names? ;-)
I was also only ranting towards the Cisco users who seem keen to do this sort of thing.... Cheers -- Alexander Clouter .sigmonster says: Life is to you a dashing and bold adventure.
participants (3)
-
Alan Buxey -
Alexander Clouter -
Guillermo Borrallo