I got this working.
I used the following config.
mac-group test1
seq 10 match mac-oui xx:xx:xx
port-access role AccessPoint
poe-priority high
stp-admin-edge-port
vlan trunk native 111
vlan trunk allowed 1,111,222,444
port-access role FallbackToSomeVlan
vlan access 2
port-access device-profile test1
enable
associate role AccessPoint
associate mac-group test1
aaa authentication port-access mac-auth
enable
interface 1/1/1
no shutdown
vlan access 1
spanning-tree bpdu-guard
spanning-tree port-type admin-edge
loop-protect
port-access fallback-role FallbackToSomeVlan
port-access device-profile
mode block-until-profile-applied
Maybe some double config here. But for me its working great.
If I plug in a device into the port with a corresponding mac as in the filter it gets the AccessPoint role.
If I plug in something else, it gets the Fallbackrole which was exactly what I wanted the port to do.
Thank you guys for pointing me towards this solution.
PS. If you add a VLAN to the TRUNK in the profile which is not existing in the config the profile will fail.
Took me a couple of hours to figure out. Typo in the config:)
Original Message:
Sent: Oct 17, 2023 05:45 PM
From: ariyap
Subject: Native vlan on ports
for using Device profiles for CX switches. check this tutorial
------------------------------
If my post was useful accept solution and/or give kudos.
Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
Original Message:
Sent: Oct 17, 2023 11:13 AM
From: JW94
Subject: Native vlan on ports
All the switches are 6100cx switches.
I will look into device-profile to check if its possible.
Thank you
Original Message:
Sent: Oct 17, 2023 09:14 AM
From: Herman Robers
Subject: Native vlan on ports
That depends on the type of switches that you have. With AOS-CX and ArubaOS-Switch you should be able to do this with device-profile or better with ClearPass (which you mentioned you don't have). For other brands/types of switches there may be similar functionality.
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
Original Message:
Sent: Oct 17, 2023 02:10 AM
From: JW94
Subject: Native vlan on ports
Hello.
I am in the process of setting up a new network.
We have quite a few access switches places around the site which primarly is for access points.
We have created a new "management" subnet and vlan so we dont use the default.
My initial thought was that we set the ports for the access points as trunk ports with native vlan 5 (the new management vlan).
By doing it that way every new access point we connect to those ports will automatically join the cluster.
Which is working very good.
One thing Im worried about though is if someone disconnects one access points and connects into the port with a computer the computer is automatically inside the management vlan (this is not good) since we have dhcp activated (for the easyness of provisioning new access points)
What Im wondering about is this: Is there someway to create port authentication on the ports so only the whitelistet mac-addresses can communicate?
We are not using any kind of radius or clearpass here.
Or could we maybe set some kind of dynamic native vlan on the ports? if mac-address equals the access point native vlan 5, else native vlan 20 (guest)
Hope someone have an easy (or hard) fix for this issue.
Best Regards