Wired Intelligent Edge

Hi.

I have 2930F switches running ArubaOS Switch. I also have configured 802.1X and MACAuth on a switch port using ClearPass. When a client authenticates successfully using 802.1X, I also see a second successful MACAuth in Access Tracker (Concurrent Onboarding).

Based on Herman' video it appears Concurrent Onboarding is enabled by default on ArubaOS Swtich but disabled on ArubaOS CX. 

Can Concurrent Onboarding be disabled on ArubaOS Switch, and instead have the switch try 802.1X and then MACAuth?

Lastly, it would seem that using Concurrent Onboarding is best practice, as it speeds up the client authentication if the 802.1X authentication request fails. Is this correct, that it is best practice? I haven't been able to find any information for ArubaOS Switch.

Thanks.

with AOS-S switches you can set the order and priority for it.
here is an example.

aaa port-access 7 auth-order authenticator mac-based

aaa port-access 7 auth-priority authenticator mac-based

------------------------------
If my post was useful accept solution and/or give kudos.
Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
------------------------------

Original Message:
Sent: Jan 09, 2023 10:38 PM
From: Matthew Collins
Subject: Is Concurrent Onboarding best practice?

Hi.

I have 2930F switches running ArubaOS Switch. I also have configured 802.1X and MACAuth on a switch port using ClearPass. When a client authenticates successfully using 802.1X, I also see a second successful MACAuth in Access Tracker (Concurrent Onboarding).

Based on Herman' video it appears Concurrent Onboarding is enabled by default on ArubaOS Swtich but disabled on ArubaOS CX.

Can Concurrent Onboarding be disabled on ArubaOS Switch, and instead have the switch try 802.1X and then MACAuth?

Lastly, it would seem that using Concurrent Onboarding is best practice, as it speeds up the client authentication if the 802.1X authentication request fails. Is this correct, that it is best practice? I haven't been able to find any information for ArubaOS Switch.

Thanks.

For colorless ports configuration, where the admin no longer have to remember the clients connected to each ports. Concurrent onboarding is the ideal solution, it may help in faster onboarding for mac authentication clients.

------------------------------
Shobana
Aruba
------------------------------

Original Message:
Sent: Jan 09, 2023 11:27 PM
From: ariyap
Subject: Is Concurrent Onboarding best practice?

with AOS-S switches you can set the order and priority for it.
here is an example.

aaa port-access 7 auth-order authenticator mac-based

aaa port-access 7 auth-priority authenticator mac-based

------------------------------
If my post was useful accept solution and/or give kudos.
Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.

Original Message:
Sent: Jan 09, 2023 10:38 PM
From: Matthew Collins
Subject: Is Concurrent Onboarding best practice?

Hi.

I have 2930F switches running ArubaOS Switch. I also have configured 802.1X and MACAuth on a switch port using ClearPass. When a client authenticates successfully using 802.1X, I also see a second successful MACAuth in Access Tracker (Concurrent Onboarding).

Based on Herman' video it appears Concurrent Onboarding is enabled by default on ArubaOS Swtich but disabled on ArubaOS CX.

Can Concurrent Onboarding be disabled on ArubaOS Switch, and instead have the switch try 802.1X and then MACAuth?

Lastly, it would seem that using Concurrent Onboarding is best practice, as it speeds up the client authentication if the 802.1X authentication request fails. Is this correct, that it is best practice? I haven't been able to find any information for ArubaOS Switch.

Thanks.

Hi.

thanks for this, this is what I was after.
Original Message:
Sent: Jan 09, 2023 11:27 PM
From: ariyap
Subject: Is Concurrent Onboarding best practice?

with AOS-S switches you can set the order and priority for it.
here is an example.

aaa port-access 7 auth-order authenticator mac-based

aaa port-access 7 auth-priority authenticator mac-based

------------------------------
If my post was useful accept solution and/or give kudos.
Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.

Original Message:
Sent: Jan 09, 2023 10:38 PM
From: Matthew Collins
Subject: Is Concurrent Onboarding best practice?

Hi.

I have 2930F switches running ArubaOS Switch. I also have configured 802.1X and MACAuth on a switch port using ClearPass. When a client authenticates successfully using 802.1X, I also see a second successful MACAuth in Access Tracker (Concurrent Onboarding).

Based on Herman' video it appears Concurrent Onboarding is enabled by default on ArubaOS Swtich but disabled on ArubaOS CX.

Can Concurrent Onboarding be disabled on ArubaOS Switch, and instead have the switch try 802.1X and then MACAuth?

Lastly, it would seem that using Concurrent Onboarding is best practice, as it speeds up the client authentication if the 802.1X authentication request fails. Is this correct, that it is best practice? I haven't been able to find any information for ArubaOS Switch.

Thanks.

Thanks Shobana
Original Message:
Sent: Jan 09, 2023 11:27 PM
From: ariyap
Subject: Is Concurrent Onboarding best practice?

with AOS-S switches you can set the order and priority for it.
here is an example.

aaa port-access 7 auth-order authenticator mac-based

aaa port-access 7 auth-priority authenticator mac-based

------------------------------
If my post was useful accept solution and/or give kudos.
Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.

Original Message:
Sent: Jan 09, 2023 10:38 PM
From: Matthew Collins
Subject: Is Concurrent Onboarding best practice?

Hi.

I have 2930F switches running ArubaOS Switch. I also have configured 802.1X and MACAuth on a switch port using ClearPass. When a client authenticates successfully using 802.1X, I also see a second successful MACAuth in Access Tracker (Concurrent Onboarding).

Based on Herman' video it appears Concurrent Onboarding is enabled by default on ArubaOS Swtich but disabled on ArubaOS CX.

Can Concurrent Onboarding be disabled on ArubaOS Switch, and instead have the switch try 802.1X and then MACAuth?

Lastly, it would seem that using Concurrent Onboarding is best practice, as it speeds up the client authentication if the 802.1X authentication request fails. Is this correct, that it is best practice? I haven't been able to find any information for ArubaOS Switch.

Thanks.