View Only
last person joined: 20 hours ago 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Cisco Wired Auth - Enforcement - Trunk Port - Port Mode

This thread has been viewed 24 times
  • 1.  Cisco Wired Auth - Enforcement - Trunk Port - Port Mode

    Posted Aug 09, 2021 09:05 AM

    Looking for a way to connect Aruba IAP's to a Cisco switch configured with Wired Auth.  To date, I instruct customers to completely remove Auth on the port. This is less then desirable as we no longer have colorless ports and now administrative burden is  back on the engineer to one-off each of the IAP ports. I understand this is a limitation with what VSA's the cisco switch supports. 

    With Aruba AOS and CX, we can send enforcement to push Untagged and Tagged VLANs to a switchport. In addition we can also enforce Port-Mode so the switchport only Authenticates the AP but not subsequent client connections. 

    I have heard rumor this is possible but have never found a way to do it! 


    Philip Wightman, ACEX (AMFX) #69. Aruba Partner Ambassador

  • 2.  RE: Cisco Wired Auth - Enforcement - Trunk Port - Port Mode

    Posted Nov 07, 2021 11:04 AM
    Are you using ClearPass as the RADIUS server for the wired authentications? We have a few thousand Aruba APs and most are on NAC'd ports. We leverage DHCP profiling and Aruba Activate Sync to have our APs identified as APs and MAC auth them successfully. 

    On router for the VLAN, add ClearPass as IP helper.
    In Aruba Activate, create user account for Clearpass
    On ClearPass add Activate as an Endpoint Context Server

    If your using Activate, your purchases should be populated in the cloud at the Distribution center, so before you even receive the gear, it can be added to your endpoints database. Through the Role mapping policy, you can reference the device-type or source of Activate and MAC auth it successfully. If Distributor does not add your devices to Activate, you can open a TAC case to have this completed upon receipt of the hardware. If you want to add your existing APs, just pull the AP database (use the long command it includes the SN) and offer that to Aruba to work on. 

    Hopefully some of that helps, good luck!

    Michael Haring

    AirHeads MVP 2017, 2019-2021

  • 3.  RE: Cisco Wired Auth - Enforcement - Trunk Port - Port Mode

    Posted Nov 08, 2021 09:31 AM
    Thanks for your tips MHaring. These are not Campus AP's. These are Instant AP's. While your suggestion is perfect identifying devices, it does not help with Enforcement to put a Cisco switchport into a trunk configuration to support the Tagged and Untagged VLANs required for an Instant AP.

    Philip Wightman, ACEX (AMFX) #69. Aruba Partner Ambassador

  • 4.  RE: Cisco Wired Auth - Enforcement - Trunk Port - Port Mode

    Posted Nov 08, 2021 05:24 AM
    It should be possible with Macros on Cisco switches but I found that Macros as defined in below post did not work on all Cisco series and a f/w update was needed on some. This customer had mostly 3950 on which some needed an update. The also had 4500 series that didn't support the macros so I never put this in production. This specific customer used controller based AP's with split-tunnel so we removed the need for the split tunnel instead.

    See this thread:

    rgds Erik

    Erik Eckhardt
    ACMX #1245, ACDX #968, ACCP, ACSP