Juniper: WakeOnLan over 802.1x without using default VLAN

Question

Case

We have a working 802.1x configuration on all our access ports. I want to enable WakeOnLan, but have no idea, how to target computers with Magic Packet.

Tests

We tried to send Magic Packet over 802.1x' Guest VLAN, but it soon prooved to be working only in certain situations, eg. when client computer was connected through VoIP Phone:

Interface    State  VLAN members        Tag   Tagging  Blocking
ge-0/0/3.0   up     GUEST               100   untagged unblocked
                    default                   untagged unblocked
                    VOIP                200   tagged   unblocked

But as soon as we reconnected computer directly, the port was still up, but JunOS downgraded the port to default VLAN (1):

Interface    State  VLAN members        Tag   Tagging  Blocking
ge-0/0/3.0   up     default                   untagged unblocked
                    VOIP                200   tagged   unblocked

Obvious solution is to send Magic Packet over default VLAN, but for several reasons this is not feasible for us (we do not want to propagate default VLAN between various segments of the network due to security and maintenance reasons).

Question

How to target Magic Packets to client computers while not utilising default VLAN?

Answer 1

There is a quite nice and simple solution:

We have utilized the voice VLAN to send Magic Packets.

Voice VLAN is configurable under:

ethernet-switching-options {
    voip {
        interface access-dot1x {
            vlan VOIP;
            forwarding-class assured-forwarding;
        }
    }
}

We were already using it to connect VoIP phones. The feature exposed defined VLAN as tagged on all affected ports and also effect in this VLAN being advertised over LLDP to phones, which will automatically attempt to communicate over advertised VLAN.

There was a doubt if a tagged Magic Packet would be recognized (and thus successfull), but tests with wide range of devices prooved positive.

Also, there was no problem with forwarding a tagged Magic Packet through VoIP phone. The trick works both with directly connected and phone-bypassed computers.

(it remains to be proven if this approach has any downsides, if you suspect any, please let me know)

Answer 2

A WoL magic packet needs to contain the magic (FF:FF:FF:FF:FF:FF followed by 16 times the destination's MAC address) anywhere within its payload.

It doesn't matter if you send it in an (unpractical) bare Ethernet frame or as (most often used) a UDP datagram to any port in an IP packet (to any IP address) - as long as you make it reach the destination port. Even VLAN tags don't matter, the destination port just has permit them out.

The frame's destination MAC address doesn't matter either. Usually, your switches will have forgotten the associated port anyway. So, you send the frame as a broadcast at all times.

When you need to cross a router you can either use directed subnet broadcasting (if the router allows) or you need to configure a static ARP address on the router's egress interface with e.g. 172.16.39.254 -> FF:FF:FF:FF:FF:FF, sending any IP packet to that address as an Ethernet broadcast.

You need to figure out what kind of frames make it out of the destination port. If these are from the default VLAN only this is your only choice. Your downgraded port should work with WoL packets over VOIP as well - if you don't want to use that you may want to add another VLAN, especially for WoL.