Security

I am attempting to write an Enforcement Profile that will quarantine a user to a "Dead" vlan on a Cisco switch.  I want to be able to manually change the user's switch port to a dead vlan with a CoA Status change from Access Tracker.

Here is my attempt at writing the profile.  When applying the CoA to the user, CPPM shows the CoA request was successful, but it doesn't change the vlan on the switch.  What am I missing?

Are you using Onguard ?

You need to send a regular VLAN enforcement profile 

Victor, I am not using OnGuard.

I tried making a VLAN Enforcement profile, but the problem is then that profile is not accessible via the Change Status from within Access Tracker.

See below.

I guess you don't want to apply a dynamic enforcement profile instead you want to do it manually ?

Correct.  I want a way from within Access Tracker to be able to manually quarantine a user off the network, by using the Change Status button and select an appropriate CoA profile to put them in another VLAN.

Did you enable CoA whe you added the NAD?

Yes, CoA is enabled on the switch.

aaa server radius dynamic-author
 client 1.1.1.1 server-key 7 <key>
 port 3799
 auth-type all

and you enabled it on the NAD definition within CPPM?

No firewall, blocking 3799 between CPPM and the switch?

Danny,

Yes is enabled in CPPM under the device profile.  No firewalls between the NAD and CPPM.

Do you know what the Enforcement Policy should look like to use it under the the Change Status button?

What version of ClearPass are you using ?

I am currently using the latest 6.4 version and it works.

Can you share you profile so I can replicate it?  I am using 6.5.  I also have 6.4, but it was not working on either version.  I likely don't have a good profile built.

I used the same enforcement profile:

Victor,

I created the same profile, but it doesn't show up in the Change Status list.  Does the order of the RADIUS attributes matter, because mine are in a different order.  I notcie that some of the Profiles in the list have brackets [ .. ].  Is there any significance to the brackets or are they just to make things stand out?

The ones in between brackets are ClearPass default profiles

Thank you Victor.  I found a Cisco document that states the switch does not support VLAN change in a CoA request.  Apparently, this works on other switch vendors, but not Cisco.  Thanks for your help.  Done beating head on this one...