3

I'm trying to configure a Cisco Nexus 5548 for 802.1x using MAC Authentication Bypass. I'm finding that there isn't an option to configure the guest VLAN in the event that authentication fails. According to this documentation it should be an available feature. But as you can see below it's not an available option.

Switch(config-if)# dot1x ?
  default            Configure Dot1x with default values for this port
  host-mode          Role of 802.1x authenticating entity
  mac-auth-bypass    Configure Mac-Auth-Bypass
  max-reauth-req     Maximum Re-authentication Attempts Before Failing
  max-req            Maximum Retries to Initiate Authentication
  pae                Role of 802.1x authenticating entity
  port-control       Port control
  re-authentication  Enable or Disable Reauthentication for this port
  timeout            Various Timeouts

I've enabled feature dot1x. Configured my radius server and preshared key. I've added the needed aaa statement as well.

I can even run: "test aaa server radius x.x.x.x testuser password" and the user account authenticates successfully. It's just the guest-vlan feature that I can't get working.

I noticed in the linked documentation that is says:

If MAB is configured, and if there is an authentication failure due to MAB, then the guest VLAN (if available), will be assigned as access VLAN.

What does it mean by (if available)? Do I need to define a VLAN and then establish it as a Guest VLAN with some sort of parameter?

I should emphasize that this is on a Nexus 5548 and not a Nexus 9000 series switch. I've read that Nexus 9Ks don't support the guest-vlan feature.

Sanitized config here:

!Command: show running-config
!Time: Tue Jan  8 18:40:24 2019

version 7.1(0)N1(1a)
hostname NexusFiveKLab

no feature telnet
feature tacacs+
feature interface-vlan
feature dot1x
feature lacp
feature lldp
feature vtp

username admin password 5 XXXXXX  role network-admin


fips mode enable
no ip domain-lookup
tacacs-server host 172.16.0.11 key 7 "XXXX"
aaa group server tacacs+ SSVR
  server 172.16.0.11
  source-interface Vlan19
radius-server host 192.168.101.11 key 7 "XXXX" authentication accounting
logging event link-status default
policy-map type network-qos jumbo
  class type network-qos class-default
    mtu 9216
    multicast-optimize
system qos
  service-policy type queuing input fcoe-default-in-policy
  service-policy type queuing output fcoe-default-out-policy
  service-policy type qos input fcoe-default-in-policy
  service-policy type network-qos jumbo
snmp-server user admin network-admin auth md5 XXXX priv XXXX localizedkey
snmp-server host 172.16.0.3 traps version 3 auth NET_MONITOR udp-port 30055
snmp-server community 5K_Lab group network-operator
ntp server 192.168.1.1 prefer
ntp source-interface Vlan10
aaa authentication login default group SSVR local
aaa authentication login console group SSVR local
aaa authorization config-commands default group SSVR local
aaa authorization commands default group SSVR local
aaa authentication dot1x default group radius
aaa accounting default group SSVR
aaa authentication login error-enable

spanning-tree vlan 10, 900, 1000 priority 24576
vrf context management
  ip route 0.0.0.0/0 192.168.1.254


interface Vlan1

interface Vlan10
  no shutdown
  ip address 192.168.1.4/25

interface Vlan101
  no shutdown
  ip address 192.168.101.2/24

interface port-channel1
  switchport mode trunk
  switchport trunk allowed vlan 4-5,10,19,119,900,1000
  speed 1000

interface Ethernet1/1
  ***The only port I've configured for dot1x is eth2/16.  All other ports are either access ports or trunk ports.***

interface Ethernet2/16
  description 802.1x Test
  dot1x port-control auto
  dot1x re-authentication
  dot1x max-req 3
  dot1x timeout quiet-period 25
  dot1x timeout re-authperiod 3300
  dot1x timeout tx-period 40
  dot1x timeout server-timeout 60
  dot1x timeout ratelimit-period 10
  dot1x timeout supp-timeout 20
  dot1x pae authenticator
  dot1x mac-auth-bypass 
  no cdp enable
  switchport access vlan 40
  speed 1000

interface mgmt0
  vrf member management
  ip address 192.168.1.2/25
cli alias name w copy system:running-config nvram:startup-config
cli alias name c config t
cli alias name sib show init brief
cli alias name sii show ip int brief
line console
line vty
boot kickstart bootflash:/n5000-uk9-kickstart.7.1.0.N1.1a.bin
boot system bootflash:/n5000-uk9.7.1.0.N1.1a.bin
ip radius source-interface Vlan101
Improve this question
4
  • Please edit your question to include the full (sanitized) configuration. Just obfuscate any passwords and public addresses.
    – Ron Maupin ♦
    Commented Jan 8, 2019 at 18:39
  • @RonMaupin, Done. I took out most of the interface configurations since most of those are only access ports or trunks that aren't participating in dot1x. Hope that's what you're looking for.
    – dutsnekcirf
    Commented Jan 8, 2019 at 20:17
  • OK. We'll see if that enough for the Nexus experts. They may ask for more.
    – Ron Maupin ♦
    Commented Jan 8, 2019 at 20:20
  • @RonMaupin, Just an update. I removed Feature VTP. It was in server mode but we weren't using it and it was bothering me that I couldn't see the VLANs that I had defined on the switch in the running-config. This switch is in a lab and so I hurt nothing by removing it. Unfortunately, I still don't have "dot1x guest-vlan" as an option on my interface.
    – dutsnekcirf
    Commented Jan 8, 2019 at 21:45

1 Answer 1

Reset to default
1

I've learned that the switch needs to be on version 7.2(0)N1 at minimum. Per the release notes; this is the version in which "Dynamic VLAN Based on MAC-Based Authentication (MAB)" was added. Once I upgraded to that version the "dot1x guest-vlan" option became available.

See the release notes here.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.