Dynamic vlan assignment with Cisco ISE

[Nemesis31]

Hi Experts,

I am running into issues with Dynamic vlan change where a managed fortiswitch is responding to radius attributes sent by Cisco ISE acting as a radius server.

I've followed the documentations and ensured that the fortinet attributes are in the Cisco ISE.

https://docs.fortinet.com/document/fortiswitch/7.2.5/administration-guide/110309/radius-change-of-au...

I've attached screenshots of the radius server and fortinet radius configuration.

We see that the ISE sending the following but, the fortinet doesn't switch the vlan.

Tunnel-Private-Group-Id
Tunnel-Medium-Type
Tunnel-Type

FGT: 7.2.5 | FSW: 7.4.0

[ebilcari]

What type of authentication are you using, PEAP with machine authentication?

The output of the session should look like this FSW (Fortilink mode) and FNAC as RADIUS server, host doing PEAP with user authentication:

GW # diag switch-controller switch-info 802.1X S108EP5918010897 port4
Managed Switch : S108EP5918010897

port4 : Mode: mac-based (mac-by-pass enable)
Link: Link up
Port State: authorized: ( )
Dynamic Allowed Vlan list: 532,540
Dynamic Untagged Vlan list: 532,540
EAP pass-through : Enable
Auth Order : MAB-dot1x
Auth Priority : Legacy
EAP egress-frame-tagged : Enable
EAP auto-untagged-vlans : Enable
Allow MAC Move From : Disable
Dynamic Access Control List : Disable
Quarantine VLAN (4093) detection : Enable
Native Vlan : 512
Allowed Vlan list: 512,532,540,4093
Untagged Vlan list: 532,540,4093
Guest VLAN :
Auth-Fail Vlan :
AuthServer-Timeout Vlan :

Switch sessions 2/80, Local port sessions:2/20
Client MAC Type Traffic-Vlan Dynamic-Vlan
00:0a:cd:38:b5:cd 802.1x 512 532
80:5e:c0:d6:6f:39 MAB 512 540

Sessions info:
00:0a:cd:38:b5:cd Type=802.1x,PEAP,state=AUTHENTICATED,etime=1,eap_cnt=11 params:reAuth=3600
user="gimi",security_grp="FNAC-Radius",fortinet_grp=""
80:5e:c0:d6:6f:39 Type=MAB,,state=AUTHENTICATED,etime=4,eap_cnt=0 params:reAuth=3600
user="80-5E-C0-D6-6F-39",security_grp="FNAC-Radius",fortinet_grp=""

and the RADIUS response for PEAP:

09:45:25.310591 IP (tos 0x0, ttl 64, id 53248, offset 0, flags [none], proto UDP (17), length 211)
10.0.0.5.1812 > 192.168.1.102.56951: RADIUS, length: 183
Access-Accept (2), id: 0x13, Authenticator: 0a4831e00b8d0c62aa721b5d58b84b27
User-Name Attribute (1), length: 6, Value: gimi
Tunnel-Type Attribute (64), length: 6, Value: Tag[Unused] VLAN
Tunnel-Private-Group-ID Attribute (81), length: 5, Value: 532
Tunnel-Medium-Type Attribute (65), length: 6, Value: Tag[Unused] 802
Vendor-Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311)
Vendor Attribute: 17, Length: 50, Value: .....|.T..~.6..I..)f.... ..[.hJ3&...C8.9.4.......j
Vendor-Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311)
Vendor Attribute: 16, Length: 50, Value: ...\ahD.*.........z..#..QO........mo.pi....R.{...
EAP-Message Attribute (79), length: 6, Value: ..
Message-Authenticator Attribute (80), length: 18, Value: .G.....

For the CoA maybe consider using the standard RFC 5176, but in your case it looks like something else is failing in the RADIUS response because there is no received VLAN shown in the session.

[Nemesis31]

Hi ebilcari,

Appreciate your response, I worked with a fortiswitch engineer and we changed the TAG to 0 on the ISE to get it working. TAG 1 is default that is supported by most vendors.

[ebilcari]

Good to know you sort it out. As a reference can you tell what does this (tag = 1) on ISE configuration do to the RADIUS response attributes?

[Nemesis31]

The tag I believe is a Cisco SGT feature and it sends the vlan change attribute in the following format by default. But the fortinet doesn't respond to coa if the TAG is 1
Tunnel-Type (tag=1) VLAN
Tunnel-Medium-Type (tag=1) 802
Tunnel-Private-Group-ID (tag=1) 20 

[FranFisc1]

Sorry... this is not correct.
This "Tag" im the RADIUS Standard Tunnel attributes
has nothing to do with the Vendor Specific Attributes for Cisco "Scalable Group Tags" (former: Security Group Tags)

Basically, a RADIUS server may respond with multiple "tunnels".

Tag
      The Tag field is one octet in length and is intended to provide a
      means of grouping attributes in the same packet which refer to the
      same tunnel.  Valid values for this field are 0x01 through 0x1F,
      inclusive.  If the Tag field is unused, it MUST be zero (0x00).

https://datatracker.ietf.org/doc/html/rfc2868