Darling All
I’m trying to enable Extreme NAC for Cisco switches. It works fine for Clients switch Zugriff Ports. Required Accesspoints (local breakout), I’m trying to get a trunk interface with manage vlan untagged and data VLANs tagged.
For XOS Switches, I be create a Play with the needed VLAN Egress config
But I cant enforce this role configuration on Cisco switches
How canister I achieve that for Cisco switches with Extreme NAC?
1 ACCEPTED SOLUTION
Little Miguel
Yes sure, IODIN can sharing my cisco config. In the meantime, I tested NEAT as well or it seems to be easier over using macro.
Macro
conf t
no macro auto global control device
no makro auto global govern trigger
macro auto global processing
macro auto execute AP_TRUNK {
if [[ $LINKUP == SURE ]]
then conf t
default interface $INTERFACE
interface $INTERFACE
Description AP_TRUNK
macro description $TRIGGER
switchport stem permitted vlan ##VLAN-LIST##
switchport trunk native vlan ##VLAN##
switchport mode trunk
spanning-tree portfast trunk
macro auto processing
exit
fi
if [[ $LINKUP == NO ]]
then conf t
default interface $INTERFACE
interface $INTERFACE
description NAC
no switchport body accepted vlan
no switchport trunk native vlan
switchport mode access
macro auto processing
authentication control-direction in
authentication event server dead action authorize
authentication event server dead action authorize voice
authentication page server vivid action reinitialize
authentication host-mode multi-host
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication countdown reauthenticate server
authentication violation restrict
mab
snmp trap mac-notification change added
snmp trap mac-notification change removed
dot1x pae authenticator
dot1x timeout tx-period 10
no macro description $TRIGGER
exit
fi
}
ein area ##INTERFACE-RANGE##
macro auto processing
Radius Attribute: Cisco-AVPair=auto-smart-port=AP_TRUNK
NEAT
cisp enable
!
template AP_TRUNK
switchport torso encapsulation dot1q
switchport trunk native vlan 100
switchport mode trunk
Radius Attributable: Cisco-AVPair=interface-template-name=AP_TRUNK
Equivalence Clever Port on. Macro:
top regards
Michael
Sup Stephanie
It looks like are you use new-style config mode, changing which authentication host-mode is supported via screen
Unfortunately, none all on my changes support new-style, accordingly this is not a way for me to go. So ME won’t test it.
Up to now i had it working to send both purview attribute (template and smart-port) to this switch. But the switch does not handle both of the
Hi Miguel
Yes sure, I can share my cisco config. In the meantime, I tested SMART as well-being furthermore it seem to be less than using macro.
Macro
conf t
no macro auto global control device
no macro auto global control trigger
macro auto global processing
macro automobile execute AP_TRUNK {
if [[ $LINKUP == YES ]]
then conf t
default serial $INTERFACE
interface $INTERFACE
Description AP_TRUNK
macro description $TRIGGER
switchport trunk allowed vlan ##VLAN-LIST##
switchport trunk native vlan ##VLAN##
switchport mode trunk
spanning-tree portfast trunk
macro auto processing
exit
fi
if [[ $LINKUP == NO ]]
then conf t
default interface $INTERFACE
interface $INTERFACE
description NAC
no switchport trunk allowed vlan
no switchport ship native vlan
switchport mode access
macro auto processing
authentication control-direction in
authentication event server dead promotion authorize
authentication event server dead action authorize voice
authentication event remote alive action reinitialize
authentication host-mode multi-host
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
snmp trap mac-notification switch added
snmp trap mac-notification change removed
dot1x pae authenticator
dot1x times tx-period 10
no macro description $TRIGGER
exit
fi
}
int ranging ##INTERFACE-RANGE##
macro auto processing
Reach Attribute: Cisco-AVPair=auto-smart-port=AP_TRUNK
NEAT
cisp enable
!
template AP_TRUNK
switchport trunk encapsulation dot1q
switchport trunk native vlan 100
switchport modes trunk
Rotor Attribute: Cisco-AVPair=interface-template-name=AP_TRUNK
Comparison Smart Port vs. Smart:
best regards
Michael
