Wired Intelligent Edge

We've gotten Wired 802.1x with MAC auth fallback working on our 5400 switches.

We can get ClearPass to assign an tagged VLAN attribute, after being be MAC authenticated.

The problem we are having is since enabling aaa on the ports, LLDP-MED is no longer advertising the tagged Voice VLAN (voice vlan is configured on the switch for the appropriate VLAN).

Is this a supported configuration? Is there a way to achieve this using user roles on the switch?

I'm working towards the same thing. You are a bit farther along. How do you tag the VLAN?

I seem to recall that the port has to be tagged with the VLAN before LLDP MED can be activated on the port. If this is the case, I wonder if the LLDP MED config can be added after the VLAN is tagged.

We tagged the VLAN using the 'HPE-Egress-VLAN-Name' attribute.

Returning '1VOICE' results in the VLAN with the name 'VOICE' being tagged on the switch port and is also helpful if you use a different voice VLAN on each switch.

Thanks for the info. One would think there would be a best practice for this type of thing. Have you made any progress?

---

@rwilsonblue wrote:

Thanks for the info. One would think there would be a best practice for this type of thing. Have you made any progress?

---

There is some change coming on new firmware ;-)

Any info on what the changes will be? :)

---

@Chris.Denham wrote:

Any info on what the changes will be? :)

---

Look release note about 16.08 :-D

From the release notes, for posterity:

Bypassing Authentication for VoIP phones With 16.08,

customers can bypass authentication for certain wired devices such as VoIP phones while still allowing the clients behind the phones to authenticate. For more information, see the Access Security Guide

Thanks Tim, that is what we will be doing :)

---

@Chris.Denham wrote:

From the release notes, for posterity:

 

Bypassing Authentication for VoIP phones With 16.08,

customers can bypass authentication for certain wired devices such as VoIP phones while still allowing the clients behind the phones to authenticate. For more information, see the Access Security Guide

---

I think more to this feature :

Device Attributes for User Roles
To simplify deployment scenarios involving APs, AOS-Switch now allows device level configurations to be added
to User Roles. For more information, see the Access Security Guide

It is possible to make this :

aaa authorization user-role name “AP”
    vlan-id 101
    vlan-id-tagged 120,121
    device
        port-mode
        admin-edge-port
    exit
exit