Wired Intelligent Edge

Hello team,

Wondering if we have any idea when multiple tagged VLANs will be supported in User-Roles? Running into issues when customers want colorless but run IAPs.

Hmm I cant seem to get that to work?

When I fill multiple vlans in the tagged part of clearpass, it gived me an error in the interface telling me that VLAN id must be a number from 1-4096.

I tried

100,200,300

100, 200, 300

100 200 300

100;200;300

What am I missing?

You also need to upgrade Clearpass to 6.7.8

Ok, I got this to work. When creating the Enforcement Profile you have to select Advanced mode, and then type the values yourself as the standard profile will not let you assign multible tagged vlans.

Example:

aaa authorization user-role name "cppmrole_854e322fd0434c4"
vlan-id 1
vlan-id-tagged 100,200,300
reauth-period 600
exit

I created a stadard profile first and copied the contents as the basis for the advanced profile.

I see that it works when you use VLAN ID's, but if using multiple names longer than 32 characters it does not work, e.g:

vlan-name-tagged xxx-corporate,xxx-guest,xxx-mobile

It comes back with the error:

Invalid vlan-name length

Using vlan-name-tagged xxx-corporate,xxx-guest,xxx-mobi works, but obvisouly the last vlan does not match

This is on 16.09.0003 on a 2930M

Need to ask to TAC...

Did you ever get this checked out with support?

I was implementing this yesterday and had to fall back to vlan-id-tagged because I could not get vlan-name-tagged working with more than 1 vlan.

My experiences with 2930F (WC.16.10.0002) and Clearpass (6.8.4) were even worse than your 32 char limit.

I tried setting this through standard and advanced. Both seemed to take it without problems. A 'show user-role download detail' also showed both vlan-named-tagged.

The switch itself didn't throw any error regarding this role either.

But still my clients ended up in the default denyall role.

I tried:

FAILS:

vlan-name MGMT
vlan-name-tagged CORPORATE-WIFI,GUEST-WIFI

FAILS (gives only the last vlan):

vlan-name MGMT
vlan-name-tagged CORPORATE-WIFI
vlan-name-tagged GUEST-WIFI

WORKS (a single vlan):

vlan-name MGMT
vlan-name-tagged GUEST-WIFI

Luckily using the same with vlan-id's did work:

vlan-id 999
vlan-id-tagged 200,210

Hi Koen,

Multiple vlan tagged name is not supported

Multiple tagged does work, you just need to ensure it is less than 32 characters, which meant i had to rename all my VLAN's.

In the end i ended up just statically coinfiguring them vs pushing from ClearPass.