Local MAC group with authenticated plus unauthenticated MAC addresses on same port

Question

I have the following setup: Aruba 2930F switches in a flat layer-2 network, which I'm trying to separate into VLANs. These switches run AOS (not CX), firmware version 16.11.008.

And I have many Ubiquiti Unifi access points, a mix of UAP-AC-PRO, U6-LR and U6-PRO, all on the latest firmware.

They currently have three VLANs:
1: Main Wifi (most known and unknown devices at the moment)
20: Public Wifi
100: Management (for management interface)

The idea is that the APs assign the VLAN for their clients (rather than the switch assigning it), and that should pass through to the switches. I'm now trying to setup automatic VLAN tagging for the access points' ports, so that it would be possible to move the APs from port to port, or set up new ones automatically. These APs do not have an EAP supplicant for their own port, so I cannot use EAP to assign the VLANs, which would have worked.

I've instead chosen to set this up using the Local MAC Group feature on the Arubas. MAC addresses matching a group will be detected, and a VLAN profile applied to that port.

The relevant config is as follows (Port 1 is the main uplink in this example)

vlan 1
   name "DEFAULT_VLAN"
   untagged 1
   no ip address
   exit

vlan 20
   name "PublicWifi"
   tagged 1
   no ip address
   exit

vlan 100
   name "Management"
   tagged 1
   ip address dhcp-bootp
   exit

aaa port-access local-mac mac-group "APs"
   mac-oui 802aa8
   exit

aaa port-access local-mac profile "APs"
   vlan tagged 20,100
   vlan untagged 1
   exit

aaa port-access local-mac apply profile "APs" mac-group "APs"
aaa port-access local-mac 5
aaa port-access local-mac 5 unauth-vid 1

As you can see, the profile to be applied to the dynamic AP ports has VLAN 1 untagged, and VLAN 20 and 100 tagged. I want unauthenticated ports to be dumped onto VLAN 1.

However, the result I'm seeing is that the port is only applying this profile for the MAC address of the actual AP, not for any subsequent MAC addresses connecting via the AP.

MySwitch# show port-access local-mac clients 5

Port Access Local MAC Authentication Client Status

 Port  MAC Address       IP Address         Client Status
 ----- ----------------- ------------------ ----------------------
 5     06a259-bfb15e     n/a                rejected no vlan
 5     78b8d6-714e2c     n/a                rejected no vlan
 5     802aa8-997fec     n/a                authenticated

Essentially I want the Local MAC authentication to act in a port-based fashion, not a per-MAC-based fashion. So the first MAC address to connect to the port (the AP) decides which profile is applied.

The documentation in Chapter 8 seems to indicate this is possible using port-based authentication, but there is no information on how to configure it. The command aaa port-access local-mac 5 addr-limit 50 did not help.

---

For clarity: I am asking for help re the Aruba switch config, not the Unifi APs.

Answer 1

I just want the switch to assign VLAN tagging for the AP ports, to avoid having to assign them manually.

That's not how it works. If you use port access security (802.1X + RADIUS), a single VLAN is assigned untagged to the authenticating client's port. You can't use MAC-based assignment as the WAP is bridging and it's the wireless clients' addresses that show up on the downlink. You'd end up assigning those MACs manually to your VLANs which a) the 2930F don't do and b) would be a real pain to manage.

What you'd really want is to assign multiple, tagged VLANs to the AP's downlink port. While there are protocols to do that automatically (GVRP, MVRP, ...), I wouldn't really recommend that - one of the VLANs needs to be the managed one that you shouldn't assign dynamically.

If the number of APs, switch ports and VLANs is too large to handle manually you might want to look out for a decent management tool. With just three VLANs and a small number of switches that isn't even necessary.

Answer 2

You need to enable "mixed mode": aaa port-access <ports> mixed

"rejected-no vlan" means unauth-vid cannot be successfully applied to the port because an authorized client has precedence.

For mixed mode to function, the unauth vlan and any guest vlan must be the same, and untagged. [ref]