radius assigned vlan & ip-phones

[Marcus J]

Hi,

Im planning for using radius assigned vlans using mac-auth.

Is it possible to send both untagged vlans and tagged vlans on the same port using mac-auth and radius assigned vlans?

A ip-phone needs both vl1(pc-vlan) untagged & Vl15(ip-phone vlan)tagged because the phone have a pc connected to it!

[Jeff Carrell]

yes it is possible to have radius "tell" the switch to put a port into a vlan, however by deafult the port will be in an untagged state...

in order for radius to "tell" the switch port to be in a tagged state, you need the following support for RFC-4675:
1) only a ProVision ASIC switch supports this, using K.13.xx version of code...
2) only a few radius appl support this: W2K8 (NAP), freeRADIUS ver 2.0.0+, later version of Steel-Belted RADIUS...

hth...jeff

[jine]

Hello,
We use Freeradius to authenticate and push the connected equipments (access points) on their VLAN.
When we use Freeradius to authenticate the access point on a port, The wireless client cannot join their VSC.




When we configure the switch port (E16) via the "menu" mode, the access point work correctly. Then, the wireless client can join their VSC and go through the VLAN affected.





Thanks for your help

[Jeff Carrell]

jine said: "Hello,
We use Freeradius to authenticate and push the connected equipments (access points) on their VLAN."

Jine, could you send me a copy of the freeradius config file(s)?

That would help me greatly trying to config freeradius in my lab!

If you would be willing to do that, send to jeff DOT carrell AT p3clabs DOT com

Thanx in advance!

[jine]

Hello Jeff
I have sent you the file in your mail box

Regards

[Jeff Carrell]

jine said "Hello Jeff
I have sent you the file in your mail box"

Many thanx Jine!!!!!!