802.1X and Guest Vlan - HP 1910 16G - (3COM 2920 SFPPLUS 3CRBSG2093)

[asantos234]

Hi,

I have a 3COM 2920 SFPPLUS 3CRBSG2093 switch which I am trying to configure with 802.1x and Guest Vlan.

If I plug in a PC with 802.1x configured to port GigabitEthernet1/0/3 and perform authentication, everything works, I am assign VLAN1. If I connect to port GigabitEthernet1/0/3 a PC without 802.1x configured I can not get guest VLAN 252.

I have followed the config "Configuring an 802.1X guest VLAN" which is on page 325 of the "HPE OfficeConnect 1910 Switch SeriesUser Guide"

Bellow is the relevant config of my switch.

Can anyone help me?

Best Regards,

André

#
 version 5.20 Release 1513P89
#
 sysname V1910-16G
#
 clock timezone UTC add 00:00:00 
#
 domain default enable teste 
#
 undo ipv6
#
 ip ttl-expires enable
#
 lldp enable
 lldp compliance cdp
#
 dot1x
 dot1x timer tx-period 40
 dot1x authentication-method eap
#
 web idle-timeout 30
#
 password-recovery enable
#
vlan 1
 description VILAN
#
vlan 10
 description MGMT
#
vlan 11
 description SAN
#
vlan 13
 description WIFI
#
vlan 69
 description ISP1
#
vlan 70
 description ISP2
#
vlan 250
 description DMZ
#
vlan 251
 description GUEST1
#
vlan 252
 description GUEST2
#
radius scheme system
 primary authentication 192.168.2.7
 key authentication cipher $c$3$xR3u/9gE/Av4JyU24qRyd+Kvv4WWcBQfo2nx
 user-name-format without-domain
 nas-ip 192.168.10.44
#
domain system 
 access-limit disable 
 state active 
 idle-cut disable 
 self-service-url disable 
domain teste 
 authentication lan-access radius-scheme system local
 authorization lan-access radius-scheme system local
 access-limit disable 
 state active 
 idle-cut disable 
 self-service-url disable 
#
pki entity v1910-16g
  common-name v1910-16g.xxx.com
  organization-unit XXXXXXXXXXXXXXXX
  organization XXXXXXXXXXXXXXx
  locality XXXx
  state XXXXX
  country XX
  fqdn v1910-16g.xxx.com
  ip 192.168.10.44
#
pki domain vi-ca
  ca identifier XXXXXXXXXX
  certificate request from ca
  certificate request entity v1910-16g
  crl check disable
#
user-group system
#
local-user admin
 password cipher $c$3$J3RLKByeKcFCAvUIKerFZNduP3SZTYeNMwUSw1kMmQ==
 authorization-attribute level 3
 service-type ssh telnet terminal
 service-type web
local-user xxxxxxx
 password cipher $c$3$nJhnTYaynDyNvaFZvSwyLyBolLLMgNPw73c=
 authorization-attribute level 3
 service-type telnet
 service-type web
#
 stp mode rstp
#
ssl server-policy access-policy
 pki-domain xxx-ca
#
interface NULL0
#
interface Vlan-interface10
 ip address 192.168.10.44 255.255.255.0 
#
interface GigabitEthernet1/0/1
 description P01->A2->NETGEAR_GS724T-P02
 port link-type hybrid
 port hybrid vlan 1 10 13 69 to 70 252 tagged
 stp edged-port enable
 lldp tlv-enable dot1-tlv vlan-name 1
 lldp tlv-enable dot1-tlv protocol-vlan-id 1
#
interface GigabitEthernet1/0/2
 port access vlan 69
 stp edged-port enable
#
interface GigabitEthernet1/0/3
 port link-type hybrid
 port hybrid vlan 1 252 untagged
 stp edged-port enable
 dot1x re-authenticate
 dot1x guest-vlan 252 
 undo dot1x handshake 
 dot1x 
#
interface GigabitEthernet1/0/4
 stp edged-port enable
#
interface GigabitEthernet1/0/5
 stp edged-port enable
#
interface GigabitEthernet1/0/6
 stp edged-port enable
#
interface GigabitEthernet1/0/7
 port access vlan 252
 stp edged-port enable
#
interface GigabitEthernet1/0/8
 stp edged-port enable
#
interface GigabitEthernet1/0/9
 stp edged-port enable
#
interface GigabitEthernet1/0/10
 stp edged-port enable
#
interface GigabitEthernet1/0/11
 stp edged-port enable
#
interface GigabitEthernet1/0/12
 stp edged-port enable
#
interface GigabitEthernet1/0/13
 stp edged-port enable
#
interface GigabitEthernet1/0/14
 stp edged-port enable
#
interface GigabitEthernet1/0/15
 stp edged-port enable
#
interface GigabitEthernet1/0/16
 stp edged-port enable
#
interface GigabitEthernet1/0/17
 stp edged-port enable
#
interface GigabitEthernet1/0/18
 stp edged-port enable
#
interface GigabitEthernet1/0/19
 stp edged-port enable
#
interface GigabitEthernet1/0/20
 stp edged-port enable
#
 ip route-static 0.0.0.0 0.0.0.0 Vlan-interface10 192.168.10.254
#
 info-center loghost 192.168.2.7
#
 snmp-agent
 snmp-agent local-engineid 8000002B0320FDF125CE31
 snmp-agent community read public 
 snmp-agent community write private 
 snmp-agent community read public 
 snmp-agent community write vrivate 
 snmp-agent sys-info contact xxxxxxxx@xxxx.xx
 snmp-agent sys-info location xxx
 snmp-agent sys-info version all
#
 ntp-service source-interface Vlan-interface10
 ntp-service unicast-server 192.168.10.251
 ntp-service unicast-server 192.168.10.252
#
 ssh server enable
 sftp server enable
#
 ip https ssl-server-policy access-policy
 ip https enable 
#
user-interface aux 0
 authentication-mode scheme
user-interface vty 0 15
 authentication-mode scheme
#
return

[asantos234]

Hi,

Can anyone give me a hint how to debug the problem with the gest vlan or what am I missing in my config?

Andre

[16again]

In global "system view" mode (not int gi1/0/3 mode! ), try adding command
dot1x guest-vlan 252