Security

last person joined: 2 hours ago 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Vlan query

Jump to Best Answer
  • 1.  Vlan query

    Posted Mar 05, 2019 03:39 PM
    Hi,

    I have two flavors of switches - hpe and Cisco.

    All ports have below config
    Access vlan 10 ,
    Voice vlan is 20
    The four vlans 10, 20,30 and 40 are configured on switch.

    Now during enforcement - CPPM is returning vlan 30 for user standard PC and vlan 40 for IP phones.

    So my question is do we have to manually put the user port in vlan 30 and IP phone in vlan 40 ?

    Or Radius attribute / enfoced vlan takes prefer ence without doing any change on anyport ?

    I need this on both Cisco and hpe switch


  • 2.  RE: Vlan query

    Posted Mar 05, 2019 03:48 PM
    Please follow the ClearPass Solution Guide for Wired Policy Enforcement.


  • 3.  RE: Vlan query

    Posted Mar 05, 2019 03:56 PM
    Hi Tim

    I have gone through it . But this is still not clear . Whatever cppm returns back as enforcement vlan, port will take it does not matter whether port is preconfigured in that vlan or not . But this is not confirmed from wired guide. And moreover for Cisco switch it is not specifically mentioned


  • 4.  RE: Vlan query

    Posted Mar 05, 2019 04:25 PM

    To the best of my knowledge, Radius assigned VLANs will always take precedence over the port VLAN. If you want to do radius authentication while still keeping the port configuration, you should be able to do a simple "allow access" radius profile








  • 5.  RE: Vlan query

    Posted Mar 05, 2019 05:17 PM
    Hello Chris . Yes radius always take preference . My query is for example radius returns vlan 20 but is it essential that port must be preconfigured in vlan 20 ? It could be configured in any vlan beforehand right ?


  • 6.  RE: Vlan query

    Posted Mar 05, 2019 05:19 PM
    No. The VLAN only needs to be defined on the switch.


  • 7.  RE: Vlan query

    Posted Mar 05, 2019 05:24 PM
    Thanks Tim .really appreciate. I guess this is applicable for Cisco ( newer version I would say) and hpe both ?


  • 8.  RE: Vlan query
    Best Answer

    Posted Mar 05, 2019 05:27 PM
    Pretty standard across the industry.


  • 9.  RE: Vlan query

    Posted Mar 05, 2019 04:38 PM
    There is a whole Cisco section of the doc...