Security

Reply
Contributor II

802.1x authentication in Aruba/HPE switches

Hello all,

 

I am now performing a study of a 802.1x solution using HPE/aruba switches. I am familiar with Cisco switches and some of the commands used to configure it on Cisco. I have been looking around in the Internet about the confguration on HPE/Aruba switches and got the following questions:

 

First, I wonder if Aruba switches have commands similar to the following commands in Cisco switches: 

- authentication event no-response action authorize vlan <vlan_id>

- authentication event fail action authorize vlan <vlan_id>

- authentication event server dead action <action>

 

I know that it is possible to configure an open VLAN mode in Aruba switches (which is equivalent to event no-response AND event fail) but I wonder if there is an equivalent to those commands.

 

Another question, is it possible to apply 802.1x auth in trunk ports? I am aware that this is not supported in Cisco devices (just asking out of curiosity since I have not found any info on the Internet)

 

Thank you very much in advance!

Guru Elite

Re: 802.1x authentication in Aruba/HPE switches

Are you referring to Aruba switches or HPE Comware switches?


Tim Cappalli | Aruba Security
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Contributor II

Re: 802.1x authentication in Aruba/HPE switches

Sorry, I meant Aruba switches. Thanks for your answer!

Guru Elite

Re: 802.1x authentication in Aruba/HPE switches

There are no direct equivalents to those commands.


Tim Cappalli | Aruba Security
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Contributor II

Re: 802.1x authentication in Aruba/HPE switches

Thanks for the answer. Furthermore, is it possible to perform 802.1x on trunk ports?

Thanks!

Guru Elite

Re: 802.1x authentication in Aruba/HPE switches

" If you enable 802.1X authentication on a port, the switch automatically disables LACP on that port. However, if the port is already operating in an LACP trunk, you must remove the port from the trunk before you can configure it for 802.1X authentication."


Tim Cappalli | Aruba Security
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Contributor II

Re: 802.1x authentication in Aruba/HPE switches

Thank you very much for the answers, Tim. I really appreciate it

Contributor I

Re: 802.1x authentication in Aruba/HPE switches

The open VLAN mode (and especially critical authentication) should give the same result as the Cisco commands in my opinion.

 

What do you mean with trunk ports? VLAN trunking or link aggregation? Aruba supports authentication at VLAN trunk interfaces. It's also possible to configure dynamically a VLAN trunk interface based on a RADIUS return. This is really useful for IAP deployments.

 

Regards,

Willem Bargeman
ACCX #822 | ACMP
Contributor II

Re: 802.1x authentication in Aruba/HPE switches

Thanks for the explanation about the open VLAN mode.

 

With trunk ports, I mean VLAN trunking. I wonder where I could find more info about configuring 802.1x on VLAN trunks since this would be really useful.

Contributor I

Re: 802.1x authentication in Aruba/HPE switches

Aruba/HPE switches does support a RADIUS return with tagged VLAN's (RFC4675). The return can contain a VLAN ID (hex value) or a VLAN name.

 

Example.

Switch is configured with 3 VLAN's. After authentication the NATIVE vlan needs to be set untagged and MANAGEMENT and DATA VLAN needs to be set tagged. Please see screenshot for an example enforcement profile

image.png

2 followed by VLAN name (example 2NATIVE) means set VLAN NATIVE untagged. 1 followed by VLAN name (example 1MANAGEMENT) means set VLAN MANAGEMENT tagged.

 

Next to this behaviour it's possbile to dynamic change the authentication at the port. It's possible to disable dot1x authentication after MAC authentication and set MAC authentication to port mode, or visa versa. This is usefull for IAP deployments. After the IAP is authenticated (via dot1x or MAC auth) to port will be open and the other clients behind the port or not authenticated anymore.

 

Example for IAP with MAC auth

image.png

Example for IAP with dot1x

image.png

Make sure you are using latest RADIUS dictionary. See attachment.

 

Regards,

Willem Bargeman
ACCX #822 | ACMP
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: