I have the following setup: Aruba 2930F switches in a flat layer-2 network, which I'm trying to separate into VLANs. These switches run AOS (not CX), firmware version 16.11.008.
And I have many Ubiquiti Unifi access points, a mix of UAP-AC-PRO, U6-LR and U6-PRO, all on the latest firmware.
They currently have three VLANs:
1: Main Wifi (most known and unknown devices at the moment)
20: Public Wifi
100: Management (for management interface)
The idea is that the APs assign the VLAN for their clients (rather than the switch assigning it), and that should pass through to the switches. I'm now trying to setup automatic VLAN tagging for the access points' ports, so that it would be possible to move the APs from port to port, or set up new ones automatically. These APs do not have an EAP supplicant for their own port, so I cannot use EAP to assign the VLANs, which would have worked.
I've instead chosen to set this up using the Local MAC Group feature on the Arubas. MAC addresses matching a group will be detected, and a VLAN profile applied to that port.
The relevant config is as follows (Port 1 is the main uplink in this example)
vlan 1
name "DEFAULT_VLAN"
untagged 1
no ip address
exit
vlan 20
name "PublicWifi"
tagged 1
no ip address
exit
vlan 100
name "Management"
tagged 1
ip address dhcp-bootp
exit
aaa port-access local-mac mac-group "APs"
mac-oui 802aa8
exit
aaa port-access local-mac profile "APs"
vlan tagged 20,100
vlan untagged 1
exit
aaa port-access local-mac apply profile "APs" mac-group "APs"
aaa port-access local-mac 5
aaa port-access local-mac 5 unauth-vid 1
As you can see, the profile to be applied to the dynamic AP ports has VLAN 1 untagged, and VLAN 20 and 100 tagged. I want unauthenticated ports to be dumped onto VLAN 1.
However, the result I'm seeing is that the port is only applying this profile for the MAC address of the actual AP, not for any subsequent MAC addresses connecting via the AP.
MySwitch# show port-access local-mac clients 5
Port Access Local MAC Authentication Client Status
Port MAC Address IP Address Client Status
----- ----------------- ------------------ ----------------------
5 06a259-bfb15e n/a rejected no vlan
5 78b8d6-714e2c n/a rejected no vlan
5 802aa8-997fec n/a authenticated
Essentially I want the Local MAC authentication to act in a port-based fashion, not a per-MAC-based fashion. So the first MAC address to connect to the port (the AP) decides which profile is applied.
The documentation in Chapter 8 seems to indicate this is possible using port-based authentication, but there is no information on how to configure it. The command aaa port-access local-mac 5 addr-limit 50
did not help.
For clarity: I am asking for help re the Aruba switch config, not the Unifi APs.