We are starting to role out Aruba 6300s and are having issues with NAC integration.
Currently a switch/port is configured as follows.
vlan 50 tagged voice
vlan 100 data
vlan 210 IOT
then each access port will configured as follows
int x/x/x
vlan trunk allowed 50,100
This works PC and Voice are connected.
Now when we enforce this port and connected a rogue PC to that phone.
That port configuration is changed from trunk to access and the vlan changes to our isolation vlan.
This kills the tagged trunk voice vlan on this port needing us to then reconfig the port manually.
This also happens when say I connected a IOT device the NAC changes the vlan but will change the port to 'access' which then kills the tagged trunk voice vlan.
What is the fix for this on Aruba Switches?
I have read FortiNAC cant manage trunk ports and to use access only, but Aruba switch's require trunk port when allowing more than one vlan on port.
Switch version: ArubaOS-CX Version : FL.10.14.0007
NAC version: CentOS 7.4.0.0427
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Didn't use Aruba switch before but I hope the following can help:
Hope it helps.
When a configuration change is done manually on the switch, a 'Resync Interfaces' may be needed from FNAC to know the current status of the ports. Is there any custom CLI configuration being pushed or RADIUS authentication involved or is just VLAN switching?
There is also a known issue '1000690 - FNAC changing VLANs on uplink ports for Aruba switches' that is solve in 9.4.6 and is not mentioned in 7.4 and may affect this setup.
Hello, it is just VLAN switch, here are some screen shots that may help explain it better.
Here is a guide I found for Phone integration, see highlighted section. even though it says cisco switches, it states to not trunk ports. But for Aruba switches you have to use trunk when configuring a port for voice vlan and another vlan.
ng.
FNAC has a separate list of commands to apply for different switch vendor/models.
For Aruba CX series it have two separate set of commands to apply the VLAN change based on the port state (tagged or access).
The port should be identified as trunk before applying the commands. FNAC will not change the port status but in this case after the 'vlan access x' is applied, by default Aruba switch will remove the trunk configuration.
You can try to configure the port as trunk and voice VLAN as tagged and than on FNAC run 'Resync Interfaces' for that switch and try to connect a host.
Hitting the same behavior where nac changes the port type from trunk to access. Once that happens it removes the voice VLAN and obviously the phones attached to the interface will stop working and drop.
On NAC logs it is observed that the TrunkPort and HasIPPhone value is false, even though there is a phone connected to that port.
Name = TrunkPort value = false
Name = HasIPPhone value = false
Name = CurrentCLI value =
Name = IPPhoneCLI value =
Name = Dot1xAutoRegister value = false
Name = DisableUplink value = false
The temp work around advised was to manually set the TrunkPort value to true
!
setportattrs -ip X.X.X.X -portIndex XXX -set -name TrunkPort -value true
!
This resolves the issue, however it is not scalable and waiting for further input from support.
*** Original Configuration ***
!
interface X/X/X
no shutdown
no routing
vlan trunk native 210 <---- Registration VLAN
vlan trunk allowed 60,210 <---- Voice and Registration VLAN
spanning-tree bpdu-guard
spanning-tree bpdu-filter
spanning-tree link-type point-to-point
spanning-tree port-type admin-edge
apply fault-monitor profile XXX
!
*** Post NAC Integration and Port Group Membership Assignment ***
interface X/X/X
no shutdown
no routing
vlan access 210 <--- Moves the port to access type and removes the voice VLAN
spanning-tree bpdu-guard
spanning-tree bpdu-filter
spanning-tree link-type point-to-point
spanning-tree port-type admin-edge
apply fault-monitor profile XXXXXXXXX
!
Thank you for sharing your findings. This seems like a device mapping issue, FNAC is not able to properly parse and save the port information received from the switch. Since you have already reported this to the TAC support, it should be fixed and included in next releases.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1660 | |
1071 | |
751 | |
443 | |
219 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.