We are starting to role out Aruba 6300s and are having issues with NAC integration.
Currently a switch/port is configured as follows.
vlan 50 tagged voice
vlan 100 data
vlan 210 IOT
then each access port will configured as follows
int x/x/x
vlan trunk allowed 50,100
This works PC and Voice are connected.
Now when we enforce this port and connected a rogue PC to that phone.
That port configuration is changed from trunk to access and the vlan changes to our isolation vlan.
This kills the tagged trunk voice vlan on this port needing us to then reconfig the port manually.
This also happens when say I connected a IOT device the NAC changes the vlan but will change the port to 'access' which then kills the tagged trunk voice vlan.
What is the fix for this on Aruba Switches?
I have read FortiNAC cant manage trunk ports and to use access only, but Aruba switch's require trunk port when allowing more than one vlan on port.
Switch version: ArubaOS-CX Version : FL.10.14.0007
NAC version: CentOS 7.4.0.0427
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Didn't use Aruba switch before but I hope the following can help:
Hope it helps.
When a configuration change is done manually on the switch, a 'Resync Interfaces' may be needed from FNAC to know the current status of the ports. Is there any custom CLI configuration being pushed or RADIUS authentication involved or is just VLAN switching?
There is also a known issue '1000690 - FNAC changing VLANs on uplink ports for Aruba switches' that is solve in 9.4.6 and is not mentioned in 7.4 and may affect this setup.
Hello, it is just VLAN switch, here are some screen shots that may help explain it better.
Here is a guide I found for Phone integration, see highlighted section. even though it says cisco switches, it states to not trunk ports. But for Aruba switches you have to use trunk when configuring a port for voice vlan and another vlan.
ng.
FNAC has a separate list of commands to apply for different switch vendor/models.
For Aruba CX series it have two separate set of commands to apply the VLAN change based on the port state (tagged or access).
The port should be identified as trunk before applying the commands. FNAC will not change the port status but in this case after the 'vlan access x' is applied, by default Aruba switch will remove the trunk configuration.
You can try to configure the port as trunk and voice VLAN as tagged and than on FNAC run 'Resync Interfaces' for that switch and try to connect a host.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.