1

I read in a lot of tutorials that i must have the ISE engine to implement auto vlan assignment using the

authentication event fail retry 3 action authorize vlan 2

command on a cisco switch? Is that correct and i cannot implement that feature on a simple standalone switch without any ISE appliance?

Currently there is a Windows Server 2012 running the NPS role which the switches authenticate against and i want to know if i can configure that feature without buying the ISE.

Improve this question
4
  • What exactly are you trying to do? Assign based on user? Assign if failed?
    – Ron Trunk
    Jan 11 at 12:21
  • I want to know if i can implement auto vlan assignment in an existing environment which only is a Windows Server with the NPS role without ISE.
    – MBrain
    Jan 11 at 12:23
  • 1
    Yes, you can do it with NPS. ISE is just fancy RADIUS server. But the details of NPS configuration should be asked on Server Fault.
    – Ron Trunk
    Jan 11 at 12:26
  • I would accept that as an answer :D
    – MBrain
    Jan 11 at 12:27

3 Answers 3

Reset to default
2

Yes, you can do it with NPS, since ISE is just fancy RADIUS server. But the details of NPS configuration should be asked on Server Fault

Improve this answer
1

You need some type of server to dynamically assign VLANs to users. You can use a RADIUIS or TACACS+ server, including ISE. Authentication happen on a server you have configured to use in the switch configuration.

The modern way to do this is with 802.1X, and that requires a server. The switch merely passes along the 802.1X authentication messages from the host to the server that you have configured in the switch. When the server replies, the replies can include a dynamic VLAN assignment, but that is not necessarily the main reason for 802.1X authentication, which is most often just authentication for the host to be allowed on the network.

Remember that switches are lean on resources, and dynamic VLAN assignment is fairly complex, so it happens on a server. Even the older VMPS needed an external server.

Improve this answer
1
  • Thank you very much. And can that server be a Windows Server running the NPS role or specifically an ISE?
    – MBrain
    Jan 11 at 12:20
1

Here are a couple of good examples of NPS configuration for Windows server to accomplish 802.1x dynamic access VLAN configuration for a port connecting to a device.

https://community.cisco.com/t5/switching/802-1x-nps-dynamic-vlan-assignment/td-p/3756533

https://networkguy.de/how-to-use-802-1xmac-auth-and-dynamic-vlan-assignment/

Hopefully that will make it easy for you to implement with a working VLAN deployment already in place and the required radius to NPS setup.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.