Hi Alan,Yes it is possible to give two vlan in Cisco as a trunk vlan and our node which is connected to Cisco port is also has two vlan 1968 and 1969 and both of them are trunk and connected to Cisco port and over it dot1x is working.Our problem is whenever we are giving one vlan in free radius server like 1968 or 1969 then Cisco AUTH VLAN is set accordingly but if we try to give two vlan together in free radius user file the. The Cisco dot1x is change to AUTH Vlan as default vlan(1). So is it poosible to give two vlan in free radius server with cisco switch and if yes the in which pattern we need to give in radius user file. Sent from Yahoo Mail for iPhone On Friday, December 10, 2021, 10:08 PM, Alan DeKok <aland@deployingradius.com> wrote: On Dec 10, 2021, at 2:51 PM, deepak rawat via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:

Our Cisco switch -3548X on version 9.3.2 is having a dot1x port based feature is enabled and connected to a free radius server for authentication. We are trying to give the multiple Vlan in the Free radius server user file so that Cisco can allow our two Vlan 1968 and Vlan1969.

We are trying the below configuration in user file of freeradius server where we are giving the two Vlan but the cisco Auth vlan is coming as default.

  What does this Cisco documentation say?  i.e. is it possible for you to assign two VLANs to the same device?   I'm not even sure that's possible.   If the Cisco documentation doesn't say that this can be done with RADIUS, then it can't be done.  This isn't a limitation of FreeRADIUS.  This is a limitation of the Cisco device.   Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hi, Thanks for the reply,  We have a Nexus 3548-X Cisco Switch and as per cisco it support the Multiple Vlan. I tried to follow this RFC4675 but not able to find any example so not sure how to configure it. I have two vlan 1968 and Vlan 1969 and both are tagged. Does it look like this E23D213926.ericsson.com Cleartext-Password := "54321"  Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802,  Tunnel-Private-Group-ID =+ 0x3100007B0,0x3100007B1 Regards,Deepak Rawat On Monday, December 13, 2021, 09:13:49 AM GMT+1, petr.linke@seznam.cz <petr.linke@seznam.cz> wrote: "Hi Alan,Yes it is possible to give two vlan in Cisco as a trunk vlan and our node which is connected to Cisco port is also has two vlan 1968 and 1969 and both of them are trunk and connected to Cisco port and over it dot1x is working.Our problem is whenever we are giving one vlan in free radius server like 1968 or 1969 then Cisco AUTH VLAN is set accordingly but if we try to give two vlan together in free radius user file the. The Cisco dot1x is change to AUTH Vlan as default vlan(1). So is it poosible to give two vlan in free radius server with cisco switch and if yes the in which pattern we need to give in radius user file. "  You must use the radius attribute egress-vlan-id to set the port as a VLAN trunk during authorization (see RFC4675). This attribute can be set multiple times (use operator =+).  See https://wiki.freeradius.org/vendor/HP#procurve -port-authentication-special-features_dynamic-vlan-assignment_rfc-4675- multiple-tagged-untagged-vlan-assignment. "  What does this Cisco documentation say?  i.e. is it possible for you to assign two VLANs to the same device? " It is dependend on version of Cisco IOS. ""   Petr Linke - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hi,What made you to comment this because dynamic vlan assignment is working in our case and Cisco is giving the vlan to the port as per input from radius server but yes not giving multiple vlan or I think I am giving the inputs in incorrect way. If you can tell me the correct format then I can try it.We raised the Cisco TAC case as well and they said they can provide multiple tunnel vlan. Maybe I misunderstood what you mean or I did it find exact words in document which you pointed Thanks  Sent from Yahoo Mail for iPhone On Monday, December 13, 2021, 12:03 PM, Brian Turnbow <b.turnbow@twt.it> wrote: Hi

Hi, Thanks for the reply, We have a Nexus 3548-X Cisco Switch and as per cisco it support the Multiple Vlan.

Nexxus 3000 series support multiple vlans, but  not assigning multiple vlan to users from radius under 802.1x The Nexus 3000 is very limted here, please see the restrictions section in the guide. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/secur... Unless there is some secret undocumented magic that I am unaware of, it is cisco.... Brian

Thanka Brian for reply. Ok I will check with Cisco TAC as well but I am just curious how can someone give two vlan in freeradius to work because we have 9000 series Cisco switch as well and we can try over it. If you could share the syntax then it would be great help to me  One more question - We have one more radius server as well which is connected in same network. So is it possible if I connect my nodes ( O have 3 nodes Which are cascaded network mean first node is connected to Cisco port 11 and second one is connected to first node port and so on for third node and authenticator and supplicant is working in all of them) to Port 11 as first node connected to port 11 and then it is connected to free radius-1 which is passing vlan 1968 and other radius -2  which will pass 1969 for second nodeWill that work? Regards,Deepak Sent from Yahoo Mail for iPhone On Monday, December 13, 2021, 1:04 PM, Brian Turnbow <b.turnbow@twt.it> wrote: <!--#yiv8499505207 _filtered {} _filtered {} _filtered {}#yiv8499505207 #yiv8499505207 p.yiv8499505207MsoNormal, #yiv8499505207 li.yiv8499505207MsoNormal, #yiv8499505207 div.yiv8499505207MsoNormal {margin:0in;margin-bottom:.0001pt;font-size:12.0pt;font-family:"Times New Roman", serif;}#yiv8499505207 a:link, #yiv8499505207 span.yiv8499505207MsoHyperlink {color:blue;text-decoration:underline;}#yiv8499505207 a:visited, #yiv8499505207 span.yiv8499505207MsoHyperlinkFollowed {color:purple;text-decoration:underline;}#yiv8499505207 p.yiv8499505207msonormal0, #yiv8499505207 li.yiv8499505207msonormal0, #yiv8499505207 div.yiv8499505207msonormal0 {margin-right:0in;margin-left:0in;font-size:12.0pt;font-family:"Times New Roman", serif;}#yiv8499505207 p.yiv8499505207yahoo-quoted-begin, #yiv8499505207 li.yiv8499505207yahoo-quoted-begin, #yiv8499505207 div.yiv8499505207yahoo-quoted-begin {margin-right:0in;margin-left:0in;font-size:12.0pt;font-family:"Times New Roman", serif;}#yiv8499505207 span.yiv8499505207EmailStyle19 {font-family:"Calibri", sans-serif;color:#1F497D;}#yiv8499505207 .yiv8499505207MsoChpDefault {font-size:10.0pt;} _filtered {}#yiv8499505207 div.yiv8499505207WordSection1 {}--> Hi Deepak   Dynamic assignment works Multiple vlans work  with multiple users when sending each user one vlan Having one user assigned multiple vlans, which was your original request,   is not possible on this switch ,or if  there is some way to it it is not documented anywhere. They are data center switches not access switches,  and do not even support the use of a voice vlan as a second vlan on the port, nor guest vlans etc. Nothing you can do in freeradius will change that.   Brian       From: deepak rawat <deepakrawat.singh@yahoo.com> Sent: Monday, December 13, 2021 12:33 PM To: Brian Turnbow <b.turnbow@twt.it>; FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Multiple Vlan assigment in Free radius server with Cisco Nexus Switch.   Hi, What made you to comment this because dynamic vlan assignment is working in our case and Cisco is giving the vlan to the port as per input from radius server but yes not giving multiple vlan or I think I am giving the inputs in incorrect way. If you can tell me the correct format then I can try it. We raised the Cisco TAC case as well and they said they can provide multiple tunnel vlan.   Maybe I misunderstood what you mean or I did it find exact words in document which you pointed  Thanks  Sent from Yahoo Mail for iPhone On Monday, December 13, 2021, 12:03 PM, Brian Turnbow <b.turnbow@twt.it> wrote: Hi

Hi, Thanks for the reply, We have a Nexus 3548-X Cisco Switch and as per cisco it support the Multiple Vlan.

Nexxus 3000 series support multiple vlans, but  not assigning multiple vlan to users from radius under 802.1x The Nexus 3000 is very limted here, please see the restrictions section in the guide. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/secur... Unless there is some secret undocumented magic that I am unaware of, it is cisco.... Brian  

Hi, Can someone tell me how we can give two Vlan in Free radius user file , It would be good if you share the example how it looks. Kind Regards,Deepak Rawat On Tuesday, December 14, 2021, 07:13:23 PM GMT+1, deepak rawat via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote: Thanks for reply  Ok I will check with Cisco TAC as well but still I want to know how can someone give two vlan in freeradius to work because we have 9000 series Cisco switch as well and we can try over it. If you could share the syntax then it would be great help to me  One more question - We have one more radius server as well which is connected in same network. So is it possible if I connect my nodes ( O have 3 nodes Which are cascaded network mean first node is connected to Cisco port 11 and second one is connected to first node port and so on for third node and authenticator and supplicant is working in all of them) to Port 11 as first node connected to port 11 and then it is connected to free radius-1 which is passing vlan 1968 and other radius -2  which will pass 1969 for second nodeWill that work? Regards,Deepak Sent from Yahoo Mail for iPhone On Monday, December 13, 2021, 1:04 PM, Brian Turnbow <b.turnbow@twt.it> wrote: <!--#yiv8499505207 _filtered {} _filtered {} _filtered {}#yiv8499505207 #yiv8499505207 p.yiv8499505207MsoNormal, #yiv8499505207 li.yiv8499505207MsoNormal, #yiv8499505207 div.yiv8499505207MsoNormal {margin:0in;margin-bottom:.0001pt;font-size:12.0pt;font-family:"Times New Roman", serif;}#yiv8499505207 a:link, #yiv8499505207 span.yiv8499505207MsoHyperlink {color:blue;text-decoration:underline;}#yiv8499505207 a:visited, #yiv8499505207 span.yiv8499505207MsoHyperlinkFollowed {color:purple;text-decoration:underline;}#yiv8499505207 p.yiv8499505207msonormal0, #yiv8499505207 li.yiv8499505207msonormal0, #yiv8499505207 div.yiv8499505207msonormal0 {margin-right:0in;margin-left:0in;font-size:12.0pt;font-family:"Times New Roman", serif;}#yiv8499505207 p.yiv8499505207yahoo-quoted-begin, #yiv8499505207 li.yiv8499505207yahoo-quoted-begin, #yiv8499505207 div.yiv8499505207yahoo-quoted-begin {margin-right:0in;margin-left:0in;font-size:12.0pt;font-family:"Times New Roman", serif;}#yiv8499505207 span.yiv8499505207EmailStyle19 {font-family:"Calibri", sans-serif;color:#1F497D;}#yiv8499505207 .yiv8499505207MsoChpDefault {font-size:10.0pt;} _filtered {}#yiv8499505207 div.yiv8499505207WordSection1 {}--> Hi Deepak   Dynamic assignment works Multiple vlans work  with multiple users when sending each user one vlan Having one user assigned multiple vlans, which was your original request,   is not possible on this switch ,or if  there is some way to it it is not documented anywhere. They are data center switches not access switches,  and do not even support the use of a voice vlan as a second vlan on the port, nor guest vlans etc. Nothing you can do in freeradius will change that.   Brian       From: deepak rawat <deepakrawat.singh@yahoo.com> Sent: Monday, December 13, 2021 12:33 PM To: Brian Turnbow <b.turnbow@twt.it>; FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Multiple Vlan assigment in Free radius server with Cisco Nexus Switch.   Hi, What made you to comment this because dynamic vlan assignment is working in our case and Cisco is giving the vlan to the port as per input from radius server but yes not giving multiple vlan or I think I am giving the inputs in incorrect way. If you can tell me the correct format then I can try it. We raised the Cisco TAC case as well and they said they can provide multiple tunnel vlan.   Maybe I misunderstood what you mean or I did it find exact words in document which you pointed  Thanks  Sent from Yahoo Mail for iPhone On Monday, December 13, 2021, 12:03 PM, Brian Turnbow <b.turnbow@twt.it> wrote: Hi

Hi, Thanks for the reply, We have a Nexus 3548-X Cisco Switch and as per cisco it support the Multiple Vlan.

Nexxus 3000 series support multiple vlans, but  not assigning multiple vlan to users from radius under 802.1x The Nexus 3000 is very limted here, please see the restrictions section in the guide. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/secur... Unless there is some secret undocumented magic that I am unaware of, it is cisco.... Brian   - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hi Alan, I can understand your point and thanks for reply. But i search all the documentation and reply which was given previously but i did not find any example or anything in Radius community or anywhere which suggest how we can give two Vlan in Radius server when the Cisco Switch is used. So if there is nothing in documentation then its hard to say how to use it which make me to end up to ask a question to expert like you. About Q:1 and Q:2 1) which attributes need to be used? - I need how we can give two vlan because i followed the RFC4675 and RFC3580 which was mentioned before and i did change the freeradius user file like this. E23D.xxx.com Cleartext-Password := "54321"  Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802,  Tunnel-Private-Group-ID = 1968,  Egress-VLANID += 0x310007B1,  Ingress-Filters = 1 Where i am giving 1968 as tagged Vlan 1968 and 0x310007B1(1969) but it did not help so i am doing something wrong here. 2) what values do those attributes need to have? - I need to know how two tagged Vlan can give in freeradius server with cisco switch. If anyone ever tried this or even it is possible or not. 3) where do you want to place these attributes (flat-text files, SQL, etc) -- I am giving these values manually no SqL, No scripts. If some one knows this then it is good if you reply and if no one know that then thanks for all the reply and help. I will try to find out and let you all know here later. RegardsDeepak  On Wednesday, December 15, 2021, 02:56:56 PM GMT+1, Alan DeKok <aland@deployingradius.com> wrote: On Dec 15, 2021, at 5:00 AM, deepak rawat via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:

Can someone tell me how we can give two Vlan in Free radius user file , It would be good if you share the example how it looks.

  The server does include every example for every possible configuration.  Instead, it documents how things work.  And it lets you put the pieces together yourself.   The questions for you are: 1) which attributes need to be used? 2) what values do those attributes need to have? 3) where do you want to place these attributes (flat-text files, SQL, etc)   We document (3).  There is a lot of documentation on how to put attributes into "files", "sql", etc.   The NAS vendor documents (1) and (2).  We do not document every possible NAS.  That's up to the vendor.   So once you know (1) and (2), you can read the FreeRADIUS documentation to learn how to do (3).   What is not appropriate is to keep asking the same question, and generally ignoring the answers.  We don't get paid to help you.  We don't get paid to run your systems for you.  If you don't have time to figure out how to do the above 3 steps, then we don't have time to do them, either.   Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hi There is a mix here of whether the port is in access mode with a vlan assigned (usual dot1x activity) , or in trunk mode with multiple vlans permitted alan