dynamic tagged and untagged vlan assignment
All, Currently i use this configuration to assign clients an ip after successfull authentication (mac authentication): user User-Password == "password" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-id = "20" This works, but now we are deploying a cisco iptel solution. The phones need to be in a tagged vlan instead of an untagged. Can i make this distinction based on radius attributes? regards, Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf@komatsu.eu Tel. +32 (0)2 2552551 "The question of whether a computer can think is no more interesting than the question of whether a submarine can swim." -- E. W. Dijkstra "This e-mail is property of the company and is supposed to contain only professional content. The company can at all times consult the content of this e-mail and the reply to this e-mail. By replying to this e-mail, you confirm your explicit agreement with the preceding." "Deze e-mail is het eigendom van de Vennootschap en wordt verondersteld enkel beroepsmatige informatie te bevatten. De Vennootschap kan ten allen tijden de inhoud van deze e-mail en van het antwoord daarop raadplegen. Door het beantwoorden van deze e-mail bevestigt U uitdrukkelijk uw akkoord met het voorafgaande."
freeradius-users-bounces+stieven.struyf=komatsu.eu@lists.freeradius.org wrote on 20-02-2008 11:36:27:
The phones need to be in a tagged vlan instead of an untagged.
Are you sure about that? You tag VLANs on a trunk port. And that port will be connected to the upstream device, not your phone. The phone is some sort of switch. Currently the edge port is statically in untagged pcvlan and tagged voice vlan. This setup works(phone has to be configured with an "admin" vlan to tag the voice packets.
"This e-mail is property of the company and is supposed to contain only professional content. The company can at all times consult the content of this e-mail and the reply to this e-mail. By replying to this e-mail, you confirm your explicit agreement with the preceding." "Deze e-mail is het eigendom van de Vennootschap en wordt verondersteld enkel beroepsmatige informatie te bevatten. De Vennootschap kan ten allen tijden de inhoud van deze e-mail en van het antwoord daarop raadplegen. Door het beantwoorden van deze e-mail bevestigt U uitdrukkelijk uw akkoord met het voorafgaande."
Ivan Kalik wrote:
The phones need to be in a tagged vlan instead of an untagged.
Are you sure about that? You tag VLANs on a trunk port. And that port will be connected to the upstream device, not your phone.
No, it's quite common for VoIP hardphones to have a passthrough port - effectively a 3-port switch - one facing the network, one facing the desktop PC, and one facing the phones internals. It's quite common to be able to put the phone on the tagged vlan and the PC on the untagged. It's less often useful IMHO, but "Cisco say so" is often the reason ;o) For interest: obviously the phone needs to know the tag number. LLDP-MED is the "normal" way of signalling this, or CDP on all-Cisco networks. Responding to the OP, whether you can do this and the syntax to use depends on your switch. For example with 3Com 4400 and (I think) Extreme x450 you do this: Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-id = "20 30t" ...to put vlan 20 untagged and 30 tagged. Some switch vendors may require a VSA to put a tagged vlan. What model switch are you using?
For interest: obviously the phone needs to know the tag number. LLDP-MED
is the "normal" way of signalling this, or CDP on all-Cisco networks.
Responding to the OP, whether you can do this and the syntax to use depends on your switch. For example with 3Com 4400 and (I think) Extreme
x450 you do this:
Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-id = "20 30t"
...to put vlan 20 untagged and 30 tagged.
I heard that cisco doesn't "do" lldp-med yet. Thanks for the info i'll try this and let you know. I'm currently running an all procurve network with 3500yl switches. I am told that with newest firmware this should be possible. "This e-mail is property of the company and is supposed to contain only professional content. The company can at all times consult the content of this e-mail and the reply to this e-mail. By replying to this e-mail, you confirm your explicit agreement with the preceding." "Deze e-mail is het eigendom van de Vennootschap en wordt verondersteld enkel beroepsmatige informatie te bevatten. De Vennootschap kan ten allen tijden de inhoud van deze e-mail en van het antwoord daarop raadplegen. Door het beantwoorden van deze e-mail bevestigt U uitdrukkelijk uw akkoord met het voorafgaande."
participants (3)
-
Ivan Kalik -
Phil Mayers -
Stieven.Struyf＠komatsu.eu