Wired Intelligent Edge

Dear all,

Setup:

• ClearPass Policy Manager 6.8.3.110034 on C2000V platform as L3-Cluster without VIP
• Aruba 2930M Switch-Stack with WC.16.09.0004 Firmware

We can enforce DUR without hassle. All currently running DURs only include a untaged VLAN:

Task:

We would like to enforce a DUR with multiple tagged VLAN (either as name or ID). Apprently, the Switch doesn't accept it:

Error:

Is this a bug? Because I can't remove the "poe-priority low" line in the Standard DUR configuration?!

So I made another (advanced) DUR, where I remove the "poe-priority low" line. Its enforced aswell but the switch still doesn't accept it:

Do you have any more troubleshooting suggestions?

Best regards,

Stefan

No sure, it is possible to push multiple vlan name, do you have try with vlan id ?

Hi alagoutte,

thanks for the fast reply.

I just tried it with multiple IDs but same problem:

So we also tried to only set ONE untagged and ONE tagged VLAN via ID. Doesn't work either!

Can you try to create the enforcement profile and select advanced mode? Then type the value yourself. 

Example:

aaa authorization user-role name "cppmrole_80d101107fb045a"
vlan-id 21
vlan-id-tagged 1,4,5
exit

Hello AirBubble,

thanks for your comment.

With your code it works fine:

But as soon as I want to use VLAN-names instead of IDs, it fails:

Is this a software bug? Why can't we assign multiple tagged VLANs using their names?

Hi,

Do you have try directly with CLI ? may be the wrong synthax

Hello,

good idea! I've tried to create the user-role manually and it works without any parsing-errors:

I can also see that all details of the role have been passed and parsed correctly from CPPM to Switch.

Any ideas why the role is not mapped to the port? Insted the "denyall" role is used ...

I just did some more checks: The exactly same role (sent via Clearpass) produces execution errors on the switch while copy pasting the exact same output from clearpass directly into the switch CLI works like a charm! This is really weird!

Clearpass OutputLeads to execution error because of "faulty line"Copying the exact same output directly into the switch CLI works like a charm

Open a case to TAC...

Hello all,

after opening a TAC Case and going thorugh all of this with a very good TAC engineer I can say that:

HPE Aruba ist not supporting multiple named tagged VLANs in a user role! (Multiple tagged VLANs by IDs are supported though).

Please keep that in mind ...

Best regards

Stefan

Hi, any update on this? Maybe in a new switch version?

---

@AirBubble wrote:

Hi, any update on this? Maybe in a new switch version?

---

No change on for moment about multiple named vlan (you can ask on innovate zone, if you want / need support)

Ok thanks.