Security

Hi Gents,

in my project I have 30 ArubaOS switches and about 70 Aruba CX switches to authenticate user with EAP-TLS.

All switches are managed in one vlan.

The NAD devices are found by the management subnet. Is there a way to make a difference between authentication from an Aruba OS and Aruba CX switch?

ArubaOS uses for example the HPE user roles, while CX uses Aruba user roles. Creating double services is an option but how can I fix it without having much administration?

The ArubaOS switches will be replaced in 2024.

Now I have a role mapping for OS and CX switches but the enforcement is not what it must be. I receive both roles and enforcements. It's an ugly config.

Any suggestion? I was looking for a NAS ID, but I have to enter all switch names or IP-addresses into it.

I don;t want to enter all switches by hand.

You can use Role Mapping to assign a Tips Role and then match that in your Enforcement to send back the correct config.

Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement EXISTS assign role ArubaOS-Switch

Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement NOT_EXISTS assign role ArubaCX-Switch

Hi Gents,

in my project I have 30 ArubaOS switches and about 70 Aruba CX switches to authenticate user with EAP-TLS.

All switches are managed in one vlan.

The NAD devices are found by the management subnet. Is there a way to make a difference between authentication from an Aruba OS and Aruba CX switch?

ArubaOS uses for example the HPE user roles, while CX uses Aruba user roles. Creating double services is an option but how can I fix it without having much administration?

The ArubaOS switches will be replaced in 2024.

Now I have a role mapping for OS and CX switches but the enforcement is not what it must be. I receive both roles and enforcements. It's an ugly config.

Any suggestion? I was looking for a NAS ID, but I have to enter all switch names or IP-addresses into it.

I don;t want to enter all switches by hand.

Thanks, seems to work on CX. Will test it tomorrow on OS.

How did you get this entry? I was searching in the request, couldn't find anything.

Regards,

Erik

You can use Role Mapping to assign a Tips Role and then match that in your Enforcement to send back the correct config.

Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement EXISTS assign role ArubaOS-Switch

Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement NOT_EXISTS assign role ArubaCX-Switch

Hi Gents,

in my project I have 30 ArubaOS switches and about 70 Aruba CX switches to authenticate user with EAP-TLS.

All switches are managed in one vlan.

The NAD devices are found by the management subnet. Is there a way to make a difference between authentication from an Aruba OS and Aruba CX switch?

ArubaOS uses for example the HPE user roles, while CX uses Aruba user roles. Creating double services is an option but how can I fix it without having much administration?

The ArubaOS switches will be replaced in 2024.

Now I have a role mapping for OS and CX switches but the enforcement is not what it must be. I receive both roles and enforcements. It's an ugly config.

Any suggestion? I was looking for a NAS ID, but I have to enter all switch names or IP-addresses into it.

I don;t want to enter all switches by hand.

These radius attributes are sent from an ArubaOS switch and not CX so can be used to distinguish between each.

Thanks, seems to work on CX. Will test it tomorrow on OS.

How did you get this entry? I was searching in the request, couldn't find anything.

Regards,

Erik

You can use Role Mapping to assign a Tips Role and then match that in your Enforcement to send back the correct config.

Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement EXISTS assign role ArubaOS-Switch

Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement NOT_EXISTS assign role ArubaCX-Switch

Hi Gents,

in my project I have 30 ArubaOS switches and about 70 Aruba CX switches to authenticate user with EAP-TLS.

All switches are managed in one vlan.

The NAD devices are found by the management subnet. Is there a way to make a difference between authentication from an Aruba OS and Aruba CX switch?

ArubaOS uses for example the HPE user roles, while CX uses Aruba user roles. Creating double services is an option but how can I fix it without having much administration?

The ArubaOS switches will be replaced in 2024.

Now I have a role mapping for OS and CX switches but the enforcement is not what it must be. I receive both roles and enforcements. It's an ugly config.

Any suggestion? I was looking for a NAS ID, but I have to enter all switch names or IP-addresses into it.

I don;t want to enter all switches by hand.

These radius attributes are sent from an ArubaOS switch and not CX so can be used to distinguish between each.

Thanks, seems to work on CX. Will test it tomorrow on OS.

How did you get this entry? I was searching in the request, couldn't find anything.

Regards,

Erik

You can use Role Mapping to assign a Tips Role and then match that in your Enforcement to send back the correct config.

Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement EXISTS assign role ArubaOS-Switch

Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement NOT_EXISTS assign role ArubaCX-Switch

Hi Gents,

in my project I have 30 ArubaOS switches and about 70 Aruba CX switches to authenticate user with EAP-TLS.

All switches are managed in one vlan.

The NAD devices are found by the management subnet. Is there a way to make a difference between authentication from an Aruba OS and Aruba CX switch?

ArubaOS uses for example the HPE user roles, while CX uses Aruba user roles. Creating double services is an option but how can I fix it without having much administration?

The ArubaOS switches will be replaced in 2024.

Now I have a role mapping for OS and CX switches but the enforcement is not what it must be. I receive both roles and enforcements. It's an ugly config.

Any suggestion? I was looking for a NAS ID, but I have to enter all switch names or IP-addresses into it.

I don;t want to enter all switches by hand.

Hi ,

When connecting a client it works on both. When connecting a VOIP-phone on an Aruba OS switch and a client it works.

It does not work when I connect a client behind a VOIP-phone on a CX switch when using EAP.

EAP packets are dropped, timeouts in ClearPass. It seems that Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement NOT_EXISTS won't give the user that given role, so the client does not recieve the role configured to get on the network.

VOIP-phones are Alcatel Lucent. Any suggestions?

These radius attributes are sent from an ArubaOS switch and not CX so can be used to distinguish between each.

Thanks, seems to work on CX. Will test it tomorrow on OS.

How did you get this entry? I was searching in the request, couldn't find anything.

Regards,

Erik

You can use Role Mapping to assign a Tips Role and then match that in your Enforcement to send back the correct config.

Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement EXISTS assign role ArubaOS-Switch

Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement NOT_EXISTS assign role ArubaCX-Switch

Hi Gents,

in my project I have 30 ArubaOS switches and about 70 Aruba CX switches to authenticate user with EAP-TLS.

All switches are managed in one vlan.

The NAD devices are found by the management subnet. Is there a way to make a difference between authentication from an Aruba OS and Aruba CX switch?

ArubaOS uses for example the HPE user roles, while CX uses Aruba user roles. Creating double services is an option but how can I fix it without having much administration?

The ArubaOS switches will be replaced in 2024.

Now I have a role mapping for OS and CX switches but the enforcement is not what it must be. I receive both roles and enforcements. It's an ugly config.

Any suggestion? I was looking for a NAS ID, but I have to enter all switch names or IP-addresses into it.

I don;t want to enter all switches by hand.

Do you see the correct role returned by ClearPass for devices that do successfully authenticate? That is what you originally opened this thread for.

To troubleshoot this further, it may be good to work with your Aruba partner or Aruba TAC. There is a lot of logs available, and you can run packet captures and debugging to find what is actually happening here. If you know whats going on, it's probably trivial to change the config which apparently has something misconfigured for your scenario.

Hi ,

When connecting a client it works on both. When connecting a VOIP-phone on an Aruba OS switch and a client it works.

It does not work when I connect a client behind a VOIP-phone on a CX switch when using EAP.

EAP packets are dropped, timeouts in ClearPass. It seems that Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement NOT_EXISTS won't give the user that given role, so the client does not recieve the role configured to get on the network.

VOIP-phones are Alcatel Lucent. Any suggestions?

These radius attributes are sent from an ArubaOS switch and not CX so can be used to distinguish between each.

Thanks, seems to work on CX. Will test it tomorrow on OS.

How did you get this entry? I was searching in the request, couldn't find anything.

Regards,

Erik

You can use Role Mapping to assign a Tips Role and then match that in your Enforcement to send back the correct config.

Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement EXISTS assign role ArubaOS-Switch

Radius:Hewlett-Packard-Enterprise:HPE-Capability-Advertisement NOT_EXISTS assign role ArubaCX-Switch

Hi Gents,

in my project I have 30 ArubaOS switches and about 70 Aruba CX switches to authenticate user with EAP-TLS.

All switches are managed in one vlan.

The NAD devices are found by the management subnet. Is there a way to make a difference between authentication from an Aruba OS and Aruba CX switch?

ArubaOS uses for example the HPE user roles, while CX uses Aruba user roles. Creating double services is an option but how can I fix it without having much administration?

The ArubaOS switches will be replaced in 2024.

Now I have a role mapping for OS and CX switches but the enforcement is not what it must be. I receive both roles and enforcements. It's an ugly config.

Any suggestion? I was looking for a NAS ID, but I have to enter all switch names or IP-addresses into it.

I don;t want to enter all switches by hand.