Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
heretolearn
New Contributor II

FortiNAC and Aruba Switch

We are starting to role out Aruba 6300s and are having issues with NAC integration.

 

Currently a switch/port is configured as follows. 

vlan 50 tagged voice 

vlan 100 data 

vlan 210 IOT 

then each access port will configured as follows

int x/x/x

vlan trunk allowed 50,100

 

This works PC and Voice are connected.

 

Now when we enforce this port and connected a rogue PC to that phone. 

That port configuration is changed from trunk to access and the vlan changes to our isolation vlan. 

This kills the tagged trunk voice vlan on this port needing us to then reconfig the port manually. 

 

This also happens when say I connected a IOT device the NAC changes the vlan but will change the port to 'access' which then kills the tagged trunk voice vlan. 

 

What is the fix for this on Aruba Switches? 

I have read FortiNAC cant manage trunk ports and to use access only, but Aruba switch's require trunk port when allowing more than one vlan on port. 

 

Switch version: ArubaOS-CX Version : FL.10.14.0007

NAC version: CentOS 7.4.0.0427

 

 

 

4 REPLIES 4
AEK
SuperUser
SuperUser

Didn't use Aruba switch before but I hope the following can help:

  • Check in Aruba doc if this is the right method to configure
  • FortiNAC never changes what it detects as IP phone in a voice VLAN. So I think either FortiNAC didn't detect it as IP phone (do you see the phone icon?), or you didn't specify in device modeling that VLAN 50 is voice VLAN

Hope it helps.

AEK
AEK
ebilcari
Staff
Staff

When a configuration change is done manually on the switch, a 'Resync Interfaces' may be needed from FNAC to know the current status of the ports. Is there any custom CLI configuration being pushed or RADIUS authentication involved or is just VLAN switching?

There is also a known issue '1000690 -  FNAC changing VLANs on uplink ports for Aruba switches' that is solve in 9.4.6 and is not mentioned in 7.4 and may affect this setup.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
heretolearn

Hello, it is just VLAN switch, here are some screen shots that may help explain it better. 2024-08-19 07_16_05-Window.png

 

Here is a guide I found for Phone integration, see highlighted section. even though it says cisco switches, it states to not trunk ports. But for Aruba switches you have to use trunk when configuring a port for voice vlan and another vlan. 

2024-08-19 07_13_00-Window.pngng. 

ebilcari

FNAC has a separate list of commands to apply for different switch vendor/models.

For Aruba CX series it have two separate set of commands to apply the VLAN change based on the port state (tagged or access).

The port should be identified as trunk before applying the commands. FNAC will not change the port status but in this case after the 'vlan access x' is applied, by default Aruba switch will remove the trunk configuration.

You can try to configure the port as trunk and voice VLAN as tagged and than on FNAC run 'Resync Interfaces' for that switch and try to connect a host.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors