- Community Home
- >
- Networking
- >
- Legacy
- >
- Switches, Hubs, Modems
- >
- Problem using IDM to assign VLAN to authenticated ...
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-29-2011 01:40 AM
09-29-2011 01:40 AM
Problem using IDM to assign VLAN to authenticated users. (802.1X EAP PEAP IAS Windows XP)
Hi...
I'm trying to set up IDM for the first time.
We have some shared office space with another company and want to allow them to share our Procurve infrastructure, while keeping traffic segregated with VLANS.
Solution I want to implement is: assign all unauthenticated machines to VLAN 39, which I have set up for the other company, while all authenticated machines should go into default VLAN 1.
I used the following command to set all unauthenticated ports to VLAN 39
aaa port-access authenticator 1-24 unauth-vid 39
I then set up IDM to assign everyone who belongs to our 'Domain Users' group to VLAN 1. I have also set up the assocaited EAP settings for the NIC in Windows itself on our machine.
The problem is that once I have applied the unauth-vid command, our own machines cannot get on to our network to authenticate the user, and are therefore 'stuck' in VLAN 39.
It only works If you log into the machine with an account that is already cached. That gets you past initial login (wihtout authenticating on AD) and into Windows. Once in, the correct VLAN is set via IDM. It's as if EAP and IDM are only working once in Windows.
I thought that the 802.1X with EAP should allow IDM to set the VLAN before even getting logged into Windows. i.e allow the VLAN to be set at the initial CTRL+ALT+DEL Windows login. This does not seem to be the case. Am I missing something?
Just to go over things.....
1. Trying to assign VLAN 1 to authenticated users VLAN 39 to non-authenticated.
2. Use 'un-auth-vid 39' command to achieve this.
3. Initially our own users are put in VLAN 39 by default before they are authenticated.
4. Our users cannot seem to get authenticated and assigned to VLAN at the initial Windows login (I thought EAP allowed this)
5. It only works if the account on the computer is pre-cached, as this gets you into Windows with local authenitcation.
6. Once in Windows, EAP/IDM seems to do it's job and subnet is changed accordingly.
7. Its as if EAP/IDM only works once into Windows.
Question:
Is it even possible to have IDM set the VLAN at the inital Windows CTRL+ALT+DEL login?
Hope that explains.
Any feedback will be greatly appreciated and Kudos bestowed upon thee.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-29-2011 06:37 AM
09-29-2011 06:37 AM
Re: Problem using IDM to assign VLAN to authenticated users. (802.1X EAP PEAP IAS Windows XP)
FYI - I have got round this issue by authenticating against the domain computer group usign the computer name.
Would still be interested to hear if it's possible doing it the way I initally tried.