802.1x authentication in Aruba/HPE switches

[kevin_pm]

Hello all,

I am now performing a study of a 802.1x solution using HPE/aruba switches. I am familiar with Cisco switches and some of the commands used to configure it on Cisco. I have been looking around in the Internet about the confguration on HPE/Aruba switches and got the following questions:

First, I wonder if Aruba switches have commands similar to the following commands in Cisco switches: 

- authentication event no-response action authorize vlan <vlan_id>

- authentication event fail action authorize vlan <vlan_id>

- authentication event server dead action <action>

I know that it is possible to configure an open VLAN mode in Aruba switches (which is equivalent to event no-response AND event fail) but I wonder if there is an equivalent to those commands.

Another question, is it possible to apply 802.1x auth in trunk ports? I am aware that this is not supported in Cisco devices (just asking out of curiosity since I have not found any info on the Internet)

Thank you very much in advance!

[cappalli · Accepted solution]

There are no direct equivalents to those commands.

[cappalli · Accepted solution]

" If you enable 802.1X authentication on a port, the switch automatically disables LACP on that port. However, if the port is already operating in an LACP trunk, you must remove the port from the trunk before you can configure it for 802.1X authentication."

[cappalli]

Are you referring to Aruba switches or HPE Comware switches?

[kevin_pm]

Sorry, I meant Aruba switches. Thanks for your answer!

[cappalli · Accepted solution]

There are no direct equivalents to those commands.

[kevin_pm]

Thanks for the answer. Furthermore, is it possible to perform 802.1x on trunk ports?

Thanks!

[cappalli · Accepted solution]

" If you enable 802.1X authentication on a port, the switch automatically disables LACP on that port. However, if the port is already operating in an LACP trunk, you must remove the port from the trunk before you can configure it for 802.1X authentication."

[kevin_pm]

Thank you very much for the answers, Tim. I really appreciate it

[Willem Bargeman]

The open VLAN mode (and especially critical authentication) should give the same result as the Cisco commands in my opinion.

What do you mean with trunk ports? VLAN trunking or link aggregation? Aruba supports authentication at VLAN trunk interfaces. It's also possible to configure dynamically a VLAN trunk interface based on a RADIUS return. This is really useful for IAP deployments.

Regards,

[kevin_pm]

Thanks for the explanation about the open VLAN mode.

With trunk ports, I mean VLAN trunking. I wonder where I could find more info about configuring 802.1x on VLAN trunks since this would be really useful.

[Willem Bargeman]

Aruba/HPE switches does support a RADIUS return with tagged VLAN's (RFC4675). The return can contain a VLAN ID (hex value) or a VLAN name.

Example.

Switch is configured with 3 VLAN's. After authentication the NATIVE vlan needs to be set untagged and MANAGEMENT and DATA VLAN needs to be set tagged. Please see screenshot for an example enforcement profile

2 followed by VLAN name (example 2NATIVE) means set VLAN NATIVE untagged. 1 followed by VLAN name (example 1MANAGEMENT) means set VLAN MANAGEMENT tagged.

Next to this behaviour it's possbile to dynamic change the authentication at the port. It's possible to disable dot1x authentication after MAC authentication and set MAC authentication to port mode, or visa versa. This is usefull for IAP deployments. After the IAP is authenticated (via dot1x or MAC auth) to port will be open and the other clients behind the port or not authenticated anymore.

Example for IAP with MAC auth

Example for IAP with dot1x

Make sure you are using latest RADIUS dictionary. See attachment.

Regards,