Security

last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Critical vlan

This thread has been viewed 24 times

  • 1.  Critical vlan

    Posted Mar 03, 2019 10:02 AM

    For wired vlan ,

    we have the cppm deployed geographically all over the world - 1 publisher and 5 subscribe.remote locations will be using the nearest subsrciber when we roll out  nac . in case of wan link issues or delays , is it ok to deploy critical vlan on cisco switches and hpe switches , is critical vlan supported on hpe switches ? do you have any sample config 



  • 2.  RE: Critical vlan

    MVP GURU
    Posted Mar 03, 2019 12:02 PM

    Yes, there is critical on HPE (Aruba) switches



  • 3.  RE: Critical vlan

    Posted Mar 04, 2019 06:41 AM

    For Aruba you can use:

    aaa port-access <port> critical-auth data-vlan <ID>

     

    For HPE Comware you can use this per port:

    mac-authentication critical vlan <ID>

    dot1x critical vlan <ID>



  • 4.  RE: Critical vlan

    Posted Dec 05, 2019 06:03 AM

    Can we use the data vlan as the critical vlan ?

     

    We dont want to deploy or create another separate critical vlan



  • 5.  RE: Critical vlan

    MVP GURU
    Posted Dec 05, 2019 06:24 AM
    @cppmadmin wrote:

    Can we use the data vlan as the critical vlan ?

     

    We dont want to deploy or create another separate critical vlan

    Yes, it is name of function ;)



  • 6.  RE: Critical vlan

    Posted Dec 05, 2019 07:16 AM

    Ok Thanks for your feedback.

     

    I have one more point .

     

    Suppose our data vlan configured is vlan 10 on the access port .

     

    What if we don’t define the critical vlan command  Dot1x critical vlan 10 And same time RADIUS Servers become unreachable .

     

    Does it put the port into data vlan ( as it is configured statically on the port) ?? or will it put the port into the default vlan configured on the switch ( which in most cases is vlan 1 ) ?

     

    The Point is what is the default behaviour of access port configured with data vlan without critical vlan configuration in case Radius becomes unreachable?

     



  • 7.  RE: Critical vlan

    Posted Dec 06, 2019 02:37 AM

    The use of critical vlan is to prevent a radius reject when the radius server becomes unavailble.

     

    When the client is rejected, it is denied access, so won't fallback to any other configured vlan.

     

    The default (untagged) vlan of the port is only applied when the radius server sends a radius-accept without any vlan attribute.