1

I have the following setup: Aruba 2930F switches in a flat layer-2 network, which I'm trying to separate into VLANs. These switches run AOS (not CX), firmware version 16.11.008.

And I have many Ubiquiti Unifi access points, a mix of UAP-AC-PRO, U6-LR and U6-PRO, all on the latest firmware.

They currently have three VLANs:
1: Main Wifi (most known and unknown devices at the moment)
20: Public Wifi
100: Management (for management interface)

The idea is that the APs assign the VLAN for their clients (rather than the switch assigning it), and that should pass through to the switches. I'm now trying to setup automatic VLAN tagging for the access points' ports, so that it would be possible to move the APs from port to port, or set up new ones automatically. These APs do not have an EAP supplicant for their own port, so I cannot use EAP to assign the VLANs, which would have worked.

I've instead chosen to set this up using the Local MAC Group feature on the Arubas. MAC addresses matching a group will be detected, and a VLAN profile applied to that port.

The relevant config is as follows (Port 1 is the main uplink in this example)

vlan 1
   name "DEFAULT_VLAN"
   untagged 1
   no ip address
   exit

vlan 20
   name "PublicWifi"
   tagged 1
   no ip address
   exit

vlan 100
   name "Management"
   tagged 1
   ip address dhcp-bootp
   exit

aaa port-access local-mac mac-group "APs"
   mac-oui 802aa8
   exit

aaa port-access local-mac profile "APs"
   vlan tagged 20,100
   vlan untagged 1
   exit

aaa port-access local-mac apply profile "APs" mac-group "APs"
aaa port-access local-mac 5
aaa port-access local-mac 5 unauth-vid 1

As you can see, the profile to be applied to the dynamic AP ports has VLAN 1 untagged, and VLAN 20 and 100 tagged. I want unauthenticated ports to be dumped onto VLAN 1.

However, the result I'm seeing is that the port is only applying this profile for the MAC address of the actual AP, not for any subsequent MAC addresses connecting via the AP.

MySwitch# show port-access local-mac clients 5

Port Access Local MAC Authentication Client Status

 Port  MAC Address       IP Address         Client Status
 ----- ----------------- ------------------ ----------------------
 5     06a259-bfb15e     n/a                rejected no vlan
 5     78b8d6-714e2c     n/a                rejected no vlan
 5     802aa8-997fec     n/a                authenticated

Essentially I want the Local MAC authentication to act in a port-based fashion, not a per-MAC-based fashion. So the first MAC address to connect to the port (the AP) decides which profile is applied.

The documentation in Chapter 8 seems to indicate this is possible using port-based authentication, but there is no information on how to configure it. The command aaa port-access local-mac 5 addr-limit 50 did not help.

For clarity: I am asking for help re the Aruba switch config, not the Unifi APs.

Improve this question
8
  • 1
    Typically, the management VLAN for a WAP is the untagged VLAN (normally VLAN 1), and the various SSIDs are translated to tagged VLANs. You seem to have that backwards.
    – Ron Maupin ♦
    Mar 13 at 17:49
  • You might be complicating things unnecessarily. Do you need to assign the VLAN based on user ID/name/group? Or is it just enough to separate guests and normal users using different SSIDs?
    – Zac67 ♦
    Mar 13 at 18:01
  • @RonMaupin I know, but it's a brownfield installation. At some point the "Main Network" VLAN will change, but either way it makes no difference: the VLANs are not being assigned
    – Charlieface
    Mar 13 at 19:54
  • @Zac67 The SSIDs are assigned a VLAN, so the AP is already tagging the packets coming from the clients. I just want the switch to assign VLAN tagging for the AP ports, to avoid having to assign them manually. I would have used EAP and our RADIUS server to do this, but these APs don't have a supplicant.
    – Charlieface
    Mar 13 at 19:56
  • That's not really how 802.1x works. The single client (MAC) that authenticates is the only one allowed access. (only auth'd hosts are allowed access, that's the whole point) What you want is a perversion of dot1x... allow all MACs once any client is authenticated. Personally, I think you're going about this totally wrong: adding an AP should require an admin to setup the switch port.
    – Ricky
    Mar 13 at 22:37

2 Answers 2

Reset to default
1

I just want the switch to assign VLAN tagging for the AP ports, to avoid having to assign them manually.

That's not how it works. If you use port access security (802.1X + RADIUS), a single VLAN is assigned untagged to the authenticating client's port. You can't use MAC-based assignment as the WAP is bridging and it's the wireless clients' addresses that show up on the downlink. You'd end up assigning those MACs manually to your VLANs which a) the 2930F don't do and b) would be a real pain to manage.

What you'd really want is to assign multiple, tagged VLANs to the AP's downlink port. While there are protocols to do that automatically (GVRP, MVRP, ...), I wouldn't really recommend that - one of the VLANs needs to be the managed one that you shouldn't assign dynamically.

If the number of APs, switch ports and VLANs is too large to handle manually you might want to look out for a decent management tool. With just three VLANs and a small number of switches that isn't even necessary.

Improve this answer
1
  • "If you use port access security (802.1X + RADIUS), a single VLAN is assigned untagged to the authenticating client's port." Aruba allows you to also set multiple tagged VLANs via EAP, using Egress-VLANID or Egress-VLAN-Name, see RFC4675.
    – Charlieface
    Mar 13 at 21:17
0

You need to enable "mixed mode": aaa port-access <ports> mixed

"rejected-no vlan" means unauth-vid cannot be successfully applied to the port because an authorized client has precedence.

For mixed mode to function, the unauth vlan and any guest vlan must be the same, and untagged. [ref]

Improve this answer
3
  • Page 607 of your linked doc. (Ch.26)
    – Ricky
    Mar 14 at 2:12
  • That could work in some situations, but here I want to allow the unauth clients onto any tagged VLANs, because the AP is tagging the correct VLAN already.
    – Charlieface
    Mar 14 at 15:24
  • If you had this in controller mode, this might work as the traffic is tunneled to the WLC. But aruba APs still use two VLANs / interfaces - management and data.
    – Ricky
    Mar 14 at 23:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.