Cloud Managed Networks

 View Only

  • 1.  Native vlan on ports

    Posted Oct 17, 2023 02:11 AM

    Hello.

    I am in the process of setting up a new network.

    We have quite a few access switches places around the site which primarly is for access points.

    We have created a new "management" subnet and vlan so we dont use the default.

    My initial thought was that we set the ports for the access points as trunk ports with native vlan 5 (the new management vlan).

    By doing it that way every new access point we connect to those ports will automatically join the cluster.

    Which is working very good.

    One thing Im worried about though is if someone disconnects one access points and connects into the port with a computer the computer is automatically inside the management vlan (this is not good) since we have dhcp activated (for the easyness of provisioning new access points)

    What Im wondering about is this: Is there someway to create port authentication on the ports so only the whitelistet mac-addresses can communicate?

    We are not using any kind of radius or clearpass here.

    Or could we maybe set some kind of dynamic native vlan on the ports? if mac-address equals the access point native vlan 5, else native vlan 20 (guest)

    Hope someone have an easy (or hard) fix for this issue.

    Best Regards



  • 2.  RE: Native vlan on ports

    Posted Oct 17, 2023 09:14 AM

    That depends on the type of switches that you have. With AOS-CX and ArubaOS-Switch you should be able to do this with device-profile or better with ClearPass (which you mentioned you don't have). For other brands/types of switches there may be similar functionality.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 3.  RE: Native vlan on ports

    Posted Oct 17, 2023 11:14 AM

    All the switches are 6100cx switches.

    I will look into device-profile to check if its possible.

    Thank you


    Original Message


  • 4.  RE: Native vlan on ports

    Posted Oct 17, 2023 05:45 PM

    for using Device profiles for CX switches. check this tutorial 



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------

    Original Message


  • 5.  RE: Native vlan on ports

    Posted Nov 13, 2023 03:04 AM

    I got this working.

    I used the following config.

    mac-group test1
        seq 10 match mac-oui xx:xx:xx
    port-access role AccessPoint
        poe-priority high
        stp-admin-edge-port
        vlan trunk native 111
        vlan trunk allowed 1,111,222,444
    port-access role FallbackToSomeVlan
        vlan access 2
    port-access device-profile test1
        enable
        associate role AccessPoint
        associate mac-group test1
    aaa authentication port-access mac-auth
        enable
    interface 1/1/1
        no shutdown
        vlan access 1
        spanning-tree bpdu-guard
        spanning-tree port-type admin-edge
        loop-protect
        port-access fallback-role FallbackToSomeVlan
        port-access device-profile
            mode block-until-profile-applied

    Maybe some double config here.  But for me its working great.

    If I plug in a device into the port with a corresponding mac as in the filter it gets the AccessPoint role.

    If I plug in something else, it gets the Fallbackrole which was exactly what I wanted the port to do.

    Thank you guys for pointing me towards this solution.

    PS. If you add a VLAN to the TRUNK in the profile which is not existing in the config the profile will fail.

    Took me a couple of hours to figure out. Typo in the config:)


    Original Message


Related Content