FortiNAC and Aruba Switch

[heretolearn]

We are starting to role out Aruba 6300s and are having issues with NAC integration.

Currently a switch/port is configured as follows. 

vlan 50 tagged voice 

vlan 100 data 

vlan 210 IOT 

then each access port will configured as follows

int x/x/x

vlan trunk allowed 50,100

This works PC and Voice are connected.

Now when we enforce this port and connected a rogue PC to that phone. 

That port configuration is changed from trunk to access and the vlan changes to our isolation vlan. 

This kills the tagged trunk voice vlan on this port needing us to then reconfig the port manually. 

This also happens when say I connected a IOT device the NAC changes the vlan but will change the port to 'access' which then kills the tagged trunk voice vlan. 

What is the fix for this on Aruba Switches? 

I have read FortiNAC cant manage trunk ports and to use access only, but Aruba switch's require trunk port when allowing more than one vlan on port. 

Switch version: ArubaOS-CX Version : FL.10.14.0007

NAC version: CentOS 7.4.0.0427

[AEK]

Didn't use Aruba switch before but I hope the following can help:

• Check in Aruba doc if this is the right method to configure
• FortiNAC never changes what it detects as IP phone in a voice VLAN. So I think either FortiNAC didn't detect it as IP phone (do you see the phone icon?), or you didn't specify in device modeling that VLAN 50 is voice VLAN

Hope it helps.

[ebilcari]

When a configuration change is done manually on the switch, a 'Resync Interfaces' may be needed from FNAC to know the current status of the ports. Is there any custom CLI configuration being pushed or RADIUS authentication involved or is just VLAN switching?

There is also a known issue '1000690 -  FNAC changing VLANs on uplink ports for Aruba switches' that is solve in 9.4.6 and is not mentioned in 7.4 and may affect this setup.

[heretolearn]

Hello, it is just VLAN switch, here are some screen shots that may help explain it better. 

Here is a guide I found for Phone integration, see highlighted section. even though it says cisco switches, it states to not trunk ports. But for Aruba switches you have to use trunk when configuring a port for voice vlan and another vlan. 

ng. 

[ebilcari]

FNAC has a separate list of commands to apply for different switch vendor/models.

For Aruba CX series it have two separate set of commands to apply the VLAN change based on the port state (tagged or access).

The port should be identified as trunk before applying the commands. FNAC will not change the port status but in this case after the 'vlan access x' is applied, by default Aruba switch will remove the trunk configuration.

You can try to configure the port as trunk and voice VLAN as tagged and than on FNAC run 'Resync Interfaces' for that switch and try to connect a host.

[magz23]

Hitting the same behavior where nac changes the port type from trunk to access. Once that happens it removes the voice VLAN and obviously the phones attached to the interface will stop working and drop.

On NAC logs it is observed that the TrunkPort and HasIPPhone value is false, even though there is a phone connected to that port. 

Name = TrunkPort value = false
Name = HasIPPhone value = false
Name = CurrentCLI value =
Name = IPPhoneCLI value =
Name = Dot1xAutoRegister value = false
Name = DisableUplink value = false

The temp work around advised was to manually set the TrunkPort value to true

!

setportattrs -ip X.X.X.X -portIndex XXX -set -name TrunkPort -value true

!

This resolves the issue, however it is not scalable and waiting for further input from support. 

*** Original Configuration ***

!
interface X/X/X
no shutdown
no routing
vlan trunk native 210 <---- Registration VLAN
vlan trunk allowed 60,210 <---- Voice and Registration VLAN
spanning-tree bpdu-guard
spanning-tree bpdu-filter
spanning-tree link-type point-to-point
spanning-tree port-type admin-edge
apply fault-monitor profile XXX

!

*** Post NAC Integration and Port Group Membership Assignment ***
interface X/X/X
no shutdown
no routing
vlan access 210 <--- Moves the port to access type and removes the voice VLAN
spanning-tree bpdu-guard
spanning-tree bpdu-filter
spanning-tree link-type point-to-point
spanning-tree port-type admin-edge
apply fault-monitor profile XXXXXXXXX

!

[ebilcari]

Thank you for sharing your findings. This seems like a device mapping issue, FNAC is not able to properly parse and save the port information received from the switch. Since you have already reported this to the TAC support, it should be fixed and included in next releases.