FortiNAC and Aruba Switch

[heretolearn]

We are starting to role out Aruba 6300s and are having issues with NAC integration.

Currently a switch/port is configured as follows. 

vlan 50 tagged voice 

vlan 100 data 

vlan 210 IOT 

then each access port will configured as follows

int x/x/x

vlan trunk allowed 50,100

This works PC and Voice are connected.

Now when we enforce this port and connected a rogue PC to that phone. 

That port configuration is changed from trunk to access and the vlan changes to our isolation vlan. 

This kills the tagged trunk voice vlan on this port needing us to then reconfig the port manually. 

This also happens when say I connected a IOT device the NAC changes the vlan but will change the port to 'access' which then kills the tagged trunk voice vlan. 

What is the fix for this on Aruba Switches? 

I have read FortiNAC cant manage trunk ports and to use access only, but Aruba switch's require trunk port when allowing more than one vlan on port. 

Switch version: ArubaOS-CX Version : FL.10.14.0007

NAC version: CentOS 7.4.0.0427

[AEK]

Didn't use Aruba switch before but I hope the following can help:

• Check in Aruba doc if this is the right method to configure
• FortiNAC never changes what it detects as IP phone in a voice VLAN. So I think either FortiNAC didn't detect it as IP phone (do you see the phone icon?), or you didn't specify in device modeling that VLAN 50 is voice VLAN

Hope it helps.

[ebilcari]

When a configuration change is done manually on the switch, a 'Resync Interfaces' may be needed from FNAC to know the current status of the ports. Is there any custom CLI configuration being pushed or RADIUS authentication involved or is just VLAN switching?

There is also a known issue '1000690 -  FNAC changing VLANs on uplink ports for Aruba switches' that is solve in 9.4.6 and is not mentioned in 7.4 and may affect this setup.

[heretolearn]

Hello, it is just VLAN switch, here are some screen shots that may help explain it better. 

Here is a guide I found for Phone integration, see highlighted section. even though it says cisco switches, it states to not trunk ports. But for Aruba switches you have to use trunk when configuring a port for voice vlan and another vlan. 

ng. 

[ebilcari]

FNAC has a separate list of commands to apply for different switch vendor/models.

For Aruba CX series it have two separate set of commands to apply the VLAN change based on the port state (tagged or access).

The port should be identified as trunk before applying the commands. FNAC will not change the port status but in this case after the 'vlan access x' is applied, by default Aruba switch will remove the trunk configuration.

You can try to configure the port as trunk and voice VLAN as tagged and than on FNAC run 'Resync Interfaces' for that switch and try to connect a host.