- Community Home
- >
- Networking
- >
- Switching and Routing
- >
- Comware Based
- >
- 3Com 5500G-EI dot1x with RADIUS Server supplied VL...
-
-
Categories
- Topics
- Hybrid IT with Cloud
- Mobile & IoT
- IT for Data & Analytics
- Transformation
- Strategy and Technology
- Products
- Cloud
- Integrated Systems
- Networking
- Servers and Operating Systems
- Services
- Storage
- Company
- Events
- Partner Solutions and Certifications
- Welcome
- Welcome
- Announcements
- Tips and Tricks
- Feedback
-
Blogs
- Alliances
- Around the Storage Block
- Behind the scenes @ Labs
- Converged Data Center Infrastructure
- Digital Transformation
- Grounded in the Cloud
- HPE Careers
- HPE Storage Tech Insiders
- Infrastructure Insights
- Inspiring Progress
- Internet of Things (IoT)
- My Learning Certification
- Networking
- OEM Solutions
- Servers: The Right Compute
- Telecom IQ
- Transforming IT
-
Quick Links
- Community
- Getting Started
- FAQ
- Ranking Overview
- Rules of Participation
- Contact
- Email us
- Tell us what you think
- Information Libraries
- Integrated Systems
- Networking
- Servers
- Storage
- Other HPE Sites
- Support Center
- Enterprise.nxt
- Marketplace
- Aruba Airheads Community
-
Categories
-
Forums
-
Blogs
-
InformationEnglish
3Com 5500G-EI dot1x with RADIUS Server supplied VLAN VSA
SOLVED- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
04-24-2017 01:30 PM
04-24-2017 01:30 PM
We have a number of 3Com 5500G-EI switches for which we'd like to enable wired 802.1x authentication.
Most swiches will be running Software Version 3Com OS V3.03.02s168p23. As for the RADIUS Server, we're using ClearPass Policy Manager 6.5.7.85381.
We have basic ACCESS-ACCEPT & ACCESS-REJECT working, along with a guest-vlan configuration.
I'm trying to assign a VLAN from the RADIUS Response, but I'm not having any luck. I suspect I may need to configure the port as a hybrid port. Here is the current port config.
interface GigabitEthernet1/0/1
stp edged-port enable
broadcast-suppression pps 3000
port access vlan 15
undo jumboframe enable
dot1x port-method portbased
dot1x max-user 1
dot1x guest-vlan 13
dot1x
dot1x re-authenticate
dot1x mandatory-domain drexel.edu
mirroring-group 1 mirroring-port both
apply qos-profile default
Based on authroization attributes, I'd like to place a user in a different VLAN if they successfully authenticate. I've made sure to pass the Radius:IETF Attributes Tunnel-Type, Tunnel-Medium-Type, & Tunnel-Private-Group-Id in the RADIUS Response, but it doesn't appear as if the switch is honoring those responses.
With Radius Debugging enabled in the switch, I see some messages with :
Apr 24 13:41:45 10.245.248.2: %%10RDS/8/DEBUG(d):- 1 -Warning:Received a invalid VLAN ID!
I've verified that the VLAN I'm sending in the RADIUS Response is configured on the switch.
Any clues or hints would be appreciated.
TIA,
--Raf
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
04-24-2017 02:28 PM
04-24-2017 02:28 PM
SolutionDOH!!!
Managed to solve my own issue by chaning the Vlan-assignment-mode to string, from interger.
I'll continue testing to see what other havoc I can create.
Does anyone know if a self-service URL will redirect users upon launching a browser, or is that only to provide a URL for admin logins?
--Raf
Hewlett Packard Enterprise International
- Communities
- HPE Blogs and Forum
© Copyright 2018 Hewlett Packard Enterprise Development LP