Security

last person joined: 5 hours ago 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

802.1x authentication in Aruba/HPE switches

Jump to Best Answer
  • 1.  802.1x authentication in Aruba/HPE switches

    Posted Feb 07, 2018 03:13 PM

    Hello all,

     

    I am now performing a study of a 802.1x solution using HPE/aruba switches. I am familiar with Cisco switches and some of the commands used to configure it on Cisco. I have been looking around in the Internet about the confguration on HPE/Aruba switches and got the following questions:

     

    First, I wonder if Aruba switches have commands similar to the following commands in Cisco switches: 

    - authentication event no-response action authorize vlan <vlan_id>

    - authentication event fail action authorize vlan <vlan_id>

    - authentication event server dead action <action>

     

    I know that it is possible to configure an open VLAN mode in Aruba switches (which is equivalent to event no-response AND event fail) but I wonder if there is an equivalent to those commands.

     

    Another question, is it possible to apply 802.1x auth in trunk ports? I am aware that this is not supported in Cisco devices (just asking out of curiosity since I have not found any info on the Internet)

     

    Thank you very much in advance!



  • 2.  RE: 802.1x authentication in Aruba/HPE switches

    Posted Feb 07, 2018 03:17 PM

    Are you referring to Aruba switches or HPE Comware switches?



  • 3.  RE: 802.1x authentication in Aruba/HPE switches

    Posted Feb 07, 2018 03:22 PM

    Sorry, I meant Aruba switches. Thanks for your answer!



  • 4.  RE: 802.1x authentication in Aruba/HPE switches
    Best Answer

    Posted Feb 07, 2018 03:41 PM

    There are no direct equivalents to those commands.



  • 5.  RE: 802.1x authentication in Aruba/HPE switches

    Posted Feb 07, 2018 03:43 PM

    Thanks for the answer. Furthermore, is it possible to perform 802.1x on trunk ports?

    Thanks!



  • 6.  RE: 802.1x authentication in Aruba/HPE switches
    Best Answer

    Posted Feb 07, 2018 03:47 PM

    " If you enable 802.1X authentication on a port, the switch automatically disables LACP on that port. However, if the port is already operating in an LACP trunk, you must remove the port from the trunk before you can configure it for 802.1X authentication."



  • 7.  RE: 802.1x authentication in Aruba/HPE switches

    Posted Feb 07, 2018 03:53 PM

    Thank you very much for the answers, Tim. I really appreciate it



  • 8.  RE: 802.1x authentication in Aruba/HPE switches

    Posted Feb 18, 2018 03:37 PM

    The open VLAN mode (and especially critical authentication) should give the same result as the Cisco commands in my opinion.

     

    What do you mean with trunk ports? VLAN trunking or link aggregation? Aruba supports authentication at VLAN trunk interfaces. It's also possible to configure dynamically a VLAN trunk interface based on a RADIUS return. This is really useful for IAP deployments.

     

    Regards,



  • 9.  RE: 802.1x authentication in Aruba/HPE switches

    Posted Feb 19, 2018 03:32 AM

    Thanks for the explanation about the open VLAN mode.

     

    With trunk ports, I mean VLAN trunking. I wonder where I could find more info about configuring 802.1x on VLAN trunks since this would be really useful.



  • 10.  RE: 802.1x authentication in Aruba/HPE switches

    Posted Feb 19, 2018 09:32 AM
      |   view attached

    Aruba/HPE switches does support a RADIUS return with tagged VLAN's (RFC4675). The return can contain a VLAN ID (hex value) or a VLAN name.

     

    Example.

    Switch is configured with 3 VLAN's. After authentication the NATIVE vlan needs to be set untagged and MANAGEMENT and DATA VLAN needs to be set tagged. Please see screenshot for an example enforcement profile

    image.png

    2 followed by VLAN name (example 2NATIVE) means set VLAN NATIVE untagged. 1 followed by VLAN name (example 1MANAGEMENT) means set VLAN MANAGEMENT tagged.

     

    Next to this behaviour it's possbile to dynamic change the authentication at the port. It's possible to disable dot1x authentication after MAC authentication and set MAC authentication to port mode, or visa versa. This is usefull for IAP deployments. After the IAP is authenticated (via dot1x or MAC auth) to port will be open and the other clients behind the port or not authenticated anymore.

     

    Example for IAP with MAC auth

    image.png

    Example for IAP with dot1x

    image.png

    Make sure you are using latest RADIUS dictionary. See attachment.

     

    Regards,

    Attachment(s)



  • 11.  RE: 802.1x authentication in Aruba/HPE switches

    Posted Feb 19, 2018 10:46 AM

    I was not aware of the RADIUS return with tagged and untagged VLANs. Thank you very much for the explanation!

     



  • 12.  RE: 802.1x authentication in Aruba/HPE switches

    Posted Feb 19, 2018 10:47 AM
    Please be aware that tagged VLAN and port auth mode VSAs cannot be used with user roles.


  • 13.  RE: 802.1x authentication in Aruba/HPE switches

    Posted Nov 01, 2018 01:53 PM

    Do you happen to know if and when DUR will be supported when IAP is in use for this exact scenario?



  • 14.  RE: 802.1x authentication in Aruba/HPE switches

    Posted Nov 01, 2018 01:55 PM
    You’ll need to reach out to your Aruba team. Roadmap cannot be discussed in a public forum.


  • 15.  RE: 802.1x authentication in Aruba/HPE switches

    Posted Nov 01, 2018 01:57 PM

    Will do. Thanks.