Security

Hello Community

After recently upgrading our network with Aruba 6200 Access Switches and 6300 Core Switches, managed via Aruba Central with the Multi-Edit feature, we're integrating ClearPass to implement both 802.1X (Dot1X) and MAC Authentication to enhance our network's security and access control.

Our network configuration is somewhat unique due to the inclusion of unmanaged switches at several workstations. This setup has necessitated specific adjustments to our managed switch configurations to accommodate the connectivity and authentication requirements of multiple devices through a single port. Specifically, we have set the client limit on our access switches to 20 (aaa authentication port-access client-limit 20) to manage the devices connected via unmanaged switches effectively.

Despite this adjustment, we're encountering challenges with inconsistent authentication behaviors, particularly where Dot1X and MAC Authentication are concerned. Below is our current configuration for the managed switches:

 no shutdown
no routing
description Access
vlan access xxx
spanning-tree bpdu-guard
spanning-tree port-type admin-edge
loop-protect
rate-limit broadcast 1000 kbps
rate-limit multicast 10000 kbps
aaa authentication port-access allow-lldp-bpdu
aaa authentication port-access client-limit 20
port-access onboarding-method concurrent enable
port-access security violation action shutdown auto-recovery enable
port-access security violation action shutdown recovery-timer 600
port-access allow-flood-traffic enable
aaa authentication port-access dot1x authenticator
    reauth
    eapol-timeout 7
    initial-auth-response-timeout 20
    max-eapol-requests 3
    max-retries 3
    reauth-period 200
    discovery-period 7
    enable
aaa authentication port-access mac-auth
    cached-reauth
    reauth
    reauth-period 200
    enable

Given the mixed environment of managed and unmanaged switches, we're seeking insights on optimizing our setup to ensure consistent and secure authentication across all devices. Is there a better approach to handling authentication in such a scenario, or does the presence of unmanaged switches necessitate a reconsideration of our network design?

We appreciate any shared experiences, advice, or configuration recommendations that could help us improve our network's reliability and security.

Thank you for your valuable insights

Kind Regards
Dia

The use of unmanaged switches is not recommended and it may indeed affect the reliability as a physical link coming up (and going down on a disconnect) helps the clients and switch to synchronize the 802.1X and MAC Authentication, and the failover between those.

It would really help to get clear what behavior you see more specific, what are the conditions when you get clients authenticated in a different state than desired, and from there see if changing the port-access timers/parameters can help to resolve those conditions. I don't know a universal good working configuration for this situation. Working with your Aruba Partner or TAC may be useful.

 no shutdownno routingdescription Accessvlan access xxxspanning-tree bpdu-guardspanning-tree port-type admin-edgeloop-protectrate-limit broadcast 1000 kbpsrate-limit multicast 10000 kbpsaaa authentication port-access allow-lldp-bpduaaa authentication port-access client-limit 20port-access onboarding-method concurrent enableport-access security violation action shutdown auto-recovery enableport-access security violation action shutdown recovery-timer 600port-access allow-flood-traffic enableaaa authentication port-access dot1x authenticator    reauth    eapol-timeout 7    initial-auth-response-timeout 20    max-eapol-requests 3    max-retries 3    reauth-period 200    discovery-period 7    enableaaa authentication port-access mac-auth    cached-reauth    reauth    reauth-period 200    enable