Technical Tip: RADIUS attributes to configure dynamic non-native VLANs

[sachitdas_FTNT]

Description	This article describes steps on how to configure dynamic assigned tag vlan on Radius Server.
Scope	FortiSwitch and FortiGate 7.0.x and above.
Solution	In some cases, requirement is to push dynamic assigned tag vlan from radius server to the FortiSwitch  for VOIP devices. Starting in FortiSwitchOS 7.0.0, the following RADIUS attributes can be used to configure dynamic non-native VLANs: 1) Egress-VLANID 2) Egress-VLAN-Name For more details, refer page#139 https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/f65c09ce-240d-11ed-9eba-fa163e... Refer to the below explanation on how to configure the radius server to send Egress-VLAN ID attribute. Egress-VLAN ID: 'Provides the VLAN identifier and controls whether egress packets are tagged (56). To set the VLAN ID value, use 0x31 for a tagged VLAN or 0x32 for an untagged VLAN.' Here is an example of how Hex value is calculated for a tagged VLAN 30 thats will be returned to FortiSwitch. 0x31<000><VLAN-ID in Hex>  the value of 30 in Hex is 1E, another 0 must be padded making it 01E. Finally, the Hex value for a tagged VLAN 30 is  0x3100001E. Now, convert HEX to Decimal. 0x3100001E in decimal is 822083614. Configuration on Radius server should be something like this (Here  FortiConnect is being used) Below is Wireshark Capture which shows the return attribute: Helpful link:- 802.1x: https://docs.fortinet.com/document/fortiswitch/7.2.2/administration-guide/110300/802-1x-authenticati... Reference KB articles:- https://community.fortinet.com/t5/FortiSwitch/Troubleshooting-Tip-Configure-and-troubleshoot-802-1x/... https://community.fortinet.com/t5/FortiSwitch/Technical-Tip-802-1x-port-based-vs-MAC-based-authentic...