Assignment of VLAN dynamic RADIUS ACS 5.2 Server with NAC

Similar Questions

• Dynamic assignment of VLANS for MAB / ACS 5.5

  Hello

  Tried MAB works with ACS 5.5, and the looks part good ACS in the newspapers - the MAC address is sought, the authorization profile is correct. But on the switch, I get the following text:

  * 1 mar 00:12:53: AAA/AUTHENTIC/8021 X (00000004): choose method list "by default".

  * 1 mar 00:12:53: RADIUS/ENCODE (00000004): orig. component type = DOT1X

  * 1 mar 00:12:53: RADIUS: AAA Attr not supported: audit-session-id [607] 24

  * 1 mar 00:12:53: RADIUS: [0A8E0FDE00000002] 30 41 38 45 30 46 44 45 30 30 30 30 30 30 30 32

  * 1 mar 00:12:53: RADIUS: 30 30 30 38 30 [00080 41A]

  * 1 mar 00:12:53: RADIUS: AAA Attr not supported: interface [171] 20

  * 1 mar 00:12:53: RADIUS: 47 69 67 61 62 69 74 45 74 68 65 72 65 74 31 [GigabitEthernet1] 6F

  * 1 mar 00:12:53: RADIUS: 2F 30 [/ 0]

  * 1 mar 00:12:53: RADIUS (00000004): Config NAS IP: 0.0.0.0

  * 1 mar 00:12:53: RADIUS / ENCODE (00000004): acct_session_id: 4

  * 1 mar 00:12:53: RADIUS (00000004): send

  * 1 mar 00:12:53: RADIUS/ENCODE: best local IP 10.142.15.222 for Radius server address - 10.54.248.55

  * 1 mar 00:12:53: RADIUS (00000004): send request to access the id 10.54.248.55:1645 1645/5, len 162

  * 1 mar 00:12:53: RADIUS: 5th authenticator FE 17 88 64 41 1 D 09-86 EA 51 BE 78 42 B6 EB

  * 1 mar 00:12:53: RADIUS: username [1] 14 "28924ad5a199".

  * 1 mar 00:12:53: RADIUS: User-Password [2] 18 *.

  * 1 mar 00:12:53: RADIUS: 6 Service-Type call control [6] [10]

  * 1 mar 00:12:53: RADIUS: Framed-MTU [12] 6 1500

  * 1 mar 00:12:53: RADIUS: Called-Station-Id [30] 19 "00-1A-A1-99-9F-82".

  * 1 mar 00:12:53: RADIUS: Calling-Station-Id [31] 19 "28-92-4A-D5-A1-99".

  * 1 mar 00:12:53: RADIUS: Message-Authenticato [80] 18

  * 1 mar 00:12:53: RADIUS: EE F5 B8 E1 70 37 A6 3A AD 89 20 A5 A7 D0 E3 B4 [p7:]

  * 1 mar 00:12:53: RADIUS: EAP-Key-Name [102] 2 *.

  * 1 mar 00:12:53: RADIUS: NAS-Port-Type [61] 6 Ethernet [15]

  * 1 mar 00:12:53: RADIUS: NAS-Port [5] 6 50102

  * 1 mar 00:12:53: RADIUS: NAS-Port-Id [87] 22 'GigabitEthernet1/0/2 '.

  * 1 mar 00:12:53: RADIUS: NAS-IP-Address [4] 6 10.142.15.222

  * 1 mar 00:12:53: RADIUS (00000004): started 5 sec timeout

  * 1 mar 00:12:53: RADIUS: receipt id 1645/5 10.54.248.55:1645, Access-Accept, len 106

  * 1 mar 00:12:53: RADIUS: authenticator 26 B4 B9 AB 3 04 68 DA - 38 AF F6 CD 36 95 73 2 b

  * 1 mar 00:12:53: RADIUS: username [1] 19 "28-92-4A-D5-A1-99".

  * 1 mar 00:12:53: RADIUS: [25] of class 31

  * 1 mar 00:12:53: RADIUS: 43 41 43 53 3 a 41 30 31 44 52 46 4 30 30 32 2F [CACS:A01DRFN002 /]

  * 1 mar 00:12:53: RADIUS: 32 33 31 35 38 38 36 30 31 31 37 38 2F [231588601/178]

  * 1 mar 00:12:53: RADIUS: Tunnel-Type [64] 01: VLAN 6 [13]

  * 1 mar 00:12:53: RADIUS: Tunnel-Medium-Type [65] 6 01:ALL_802 [6]

  * 1 mar 00:12:53: RADIUS: Message-Authenticato [80] 18

  * 1 mar 00:12:53: RADIUS: 91 22 50 8 62 C2 F0 10 C6 OF 70 84 AF 31 6 CD [Pbp1l ""]

  * 1 mar 00:12:53: RADIUS: mount-Auth-Type [81] 6 20003120

  * 1 mar 00:12:53: RADIUS (00000004): receipt of id 1645/5

  * 1 mar 00:12:53: RADIUS: unsupported value 20003120 to the 81 attribute

  * 1 mar 00:12:53: RADIUS/DECODE: Ascend auth type; IN CASE OF FAILURE

  * 1 mar 00:12:53: RADIUS/DECODE: decoder; IN CASE OF FAILURE

  * 1 mar 00:12:53: RADIUS/DECODE: Ascend-Auth-Type attribute; IN CASE OF FAILURE

  * 1 mar 00:12:53: RADIUS/DECODE: analysis response op decode; IN CASE OF FAILURE

  * 1 mar 00:12:53: RADIUS/DECODE: analyze the answer; IN CASE OF FAILURE

  * 1 mar 00:12:53: % MAB-5-FAIL: failure of authentication for the client (2892.4ad5.a199) on the Interface item in gi1/0/2 AuditSessionID 0A8E0FDE0000000200080ABF

  * 1 mar 00:12:53: % AUTHMGR-7-RESULT: result of the "dead server" authentication "MAB" for the client (2892.4ad5.a199) on the Interface item in gi1/0/2 AuditSessionID 0A8E0FDE0000000200080ABF

  * 1 mar 00:12:53: % AUTHMGR-5-FAIL: failed authorization for customer (2892.4ad5.a199) on the Interface item in gi1/0/2 AuditSessionID 0A8E0FDE0000000200080ABF

  It recognizes the attributes 64 and 65, but the Tunnel-private-group-id, which contains the actual number of VLAN is not supported. How can I assign the vlan OK if this attribute is not taken in charge? Does not work with a string corresponding to the name VLAN on the switch either.

  The version is 12.2.55SE10 3750G.

  Hello

  Since him debugs if I see that you are missing an attribute to make the assignment of VLANs, in your test it just to send the following items:

  * 1 mar 00:12:53: RADIUS: Tunnel-Type [64] 01: VLAN 6 [13]

  * 1 mar 00:12:53: RADIUS: Tunnel-Medium-Type [65] 6 01:ALL_802 [6]

  But it would be appropriate to send:

  • Tunnel-Type = 64 = VLAN

  • Tunnel-Medium-Type = 802

  • Tunnel-private-Group-ID = 253

  When the "Tunnel-private-Group-ID" is the number/name of vlan to be awarded, the bellows is an example on what it would look like on the profile of the ACS:

  http://www.Cisco.com/c/dam/en/us/support/docs/wireless/5500-series-wirel...

  Note: Please mark as answer as appropriate

• Assignment of VLAN dynamic of the Web authentication

  In a firmware WLC 4402 v.5.2.157 is possible to assign users to one VLAN dynamic based on the RADIUS response received from ACS?

  Yes and no. You can do for a WLAN 802.1 x internal, that the customer does not get an IP address, until they have completed the authentication process. To do this, you use 64/65/81, 64 802, 65 VLAN and to 81 use the name of the interface, not the number VLAN. you will also need to make sure you have AAA Overrided activated under the WLAN.

  If, as is said for Web authentication, the answer is no. The client has an IP address before being validated by the AAA server.

  HTH,

  Steve

• Assignment of VLAN dynamic by using the WC7520 controller

  Hello

  I use a few AP WNDAP360 for awhile and consider adding a WC7520 controller.

  However, I would use an assignment VLAN dynamic using a RADIUS server.

  Whereas it is possible with the 360 in stand-alone mode, it is clear to me if this can be done by using the WC7520 controller.

  The (obsolete?) reference manual said not a Word to this topic...

  Is there someone to share experiences with the 7520 and this type of configuration?

  Hello

  Thanks for your help!

  After reading the articles you suggested, I was still unable to find a definitive answer, so I asked pre-sales support and quickly received the following response from Tech Support level 2:

  There was a feature request to ask to implement, but it looks like it will not be implemented for the WC7520. Also, there is a feature request for the WC7600 which looks more promising, but still not possible currently and is not guaranteed to be implemented.

  In short: no, it is not possible, will not be on the WC7520 and could become so on the WC7600.

  Too bad, and it makes the much less interesting WC7520 for me, but at least it clearly quickly.

• 802. 1 x assignment of vlan dynamic based on MAC?

  Hello

  I use Catalyst3750 and authentication widows AD.

  Our customers PC is driving Windows (is not able 802. 1 x) which is connected to the catalyst switch.

  Is it possible to dynamic assignment of that one Vlan based on MAC?

  When possible, we want to do it without help of VMPS.

  and is there any document relating to the foregoing.

  Thank you very much for you help.

  Tomoyuki

  Tomoyuki Hello,

  What Radius server that you use to authenticate your Clients?

  To Secure ACS, you can configure a feature called "MAC-Authentication-Bypass" that accomplishes your needs.

  This feature must be configured on the switch and the Radius Server (which makes the responsibilities of vlan based on the MAC address of the Client)

  An overview of this feature can be found here:

  http://www.Cisco.com/univercd/CC/TD/doc/solution/macauthb.PDF

  I hope this helps.

  Kind regards

  Chris

• 4.1 of the ACS and 802. 1 x dynamic assignment of VLANS

  Hi guys,.

  a customer wants to implement assignment of VLANs with 802 dynamics. 1 x. The customer has the following facilities, Cisco ACS 4.1 for Windows, Cisco ASA 5540, CSA 5.2 with CSA MC, several routers and Cisco switches.

  Now, the questations are, we can implement assignment of vlan dynamic without a unit of the ANC and the customer also wants to decide between customers with real antivirus signatures and the old signatures. Older clients are denied access to the anti-virus server and the update of the signature and if everything is ok, to have access to the internal network.

  How could implement us this without a new hardware or software?

  Any ideas? Thanks for help.

  René

  You can have a look on the frame of the NAC system. If you want only the posture validate cable customers then there no extra components to buy. If you want to go wireless, you will likely need to buy a Cisco client that supports wireless. You can get the configuration from here guide:

  http://www.Cisco.com/application/PDF/en/us/guest/NetSol/ns617/c649/cdccont_0900aecd8040bbd8.PDF

  I suggest you prototype and see what you think, the good thing is that you can deploy on a per switchport basis so you can make the installer on ACS without disturbing what is there already and apply it by configuring the switch.

• SG300: Cant assign aw vlan 802. 1 x + freeradius

  We recently got SG300-10 and try to get the assignment of vlan dynamic works via 802.1 x and freeradius. We got it so that the client connected to the SG300 would correctly auth, IE, I see this in "see the dot1x users:

  MAC               Auth   Auth   Session        VLAN
  Port     Username         Address           Method Server Time
  -------- ---------------- ----------------- ------ ------ -------------- ----
  gi7      testuser         58:55:ca:24:19:d4 802.1X Remote 00:04:39
  

  However, the client does not seem to be at all on the vlan correct or any vlan. If I change the port of "dot1x - radius attributes vlan static" to "dot1x - radius attributes vlan" then the customer cant auth at all (which is expected because it cannot retrieve the information of vlan).

  The freeradius users file looks like this:

  testuser  Cleartext-Password := "testpassword"
  ##Tunnel-Tag = 0,
  Tunnel-Medium-Type = IEEE-802,
  Tunnel-Type = VLAN,
  Tunnel-Private-Group-Id = "104"
  

  There is this whole line in the eap.conf file:

  copy_request_to_tunnel = yes
  

  Running config:

  net055#show running-config
  config-file-header
  net055
  v1.3.5.58 / R750_NIK_1_35_647_358
  CLI v1.0
  set system mode switch
  file SSD indicator encrypted
  @
  ssd-control-start
  ssd config
  ssd file passphrase control unrestricted
  no ssd file integrity control
  ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0
  !
  vlan database
  default-vlan vlan 3333
  exit
  vlan database
  vlan 1,100,104,111
  exit
  voice vlan oui-table add 0001e3 Siemens_AG_phone________
  voice vlan oui-table add 00036b Cisco_phone_____________
  voice vlan oui-table add 00096e Avaya___________________
  voice vlan oui-table add 000fe2 H3C_Aolynk______________
  voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
  voice vlan oui-table add 00d01e Pingtel_phone___________
  voice vlan oui-table add 00e075 Polycom/Veritel_phone___
  voice vlan oui-table add 00e0bb 3Com_phone______________
  dot1x system-auth-control
  hostname net055
  line console
  exec-timeout 30
  exit
  line ssh
  exec-timeout 0
  exit
  encrypted radius-server host 172.16.200.57 key #REMOVED priority 10 usage dot1.x
  radius-server host source-interface vlan 100
  management access-list mlist2
  permit ip-source 172.16.202.0 mask 255.255.255.0
  permit ip-source 172.16.200.0 mask 255.255.255.0
  exit
  management access-class mlist2
  logging buffered debugging
  aaa authentication enable default enable none
  aaa accounting dot1x start-stop group radius
  enable password level 15 encrypted #REMOVED
  no service password-recovery
  no passwords complexity enable
  passwords aging 0
  username #REMOVED password encrypted #REMOVED privilege 15
  username #REMOVED password encrypted #REMOVED privilege 15
  ip ssh server
  ip ssh password-auth
  ip http timeout-policy 1800 https-only
  no ip http server
  tacacs-server timeout 10
  clock timezone " " 0 minutes 0
  clock source sntp
  !
  interface vlan 100
  ip address 172.16.200.21 255.255.255.0
  no ip address dhcp
  !
  interface vlan 104
  name gen-0-Gnv-204.0
  !
  interface vlan 111
  name guest-0-Gnv-10-66-61.0
  dot1x guest-vlan
  !
  interface gigabitethernet1
  switchport trunk allowed vlan add 100,104,111
  !
  interface gigabitethernet7
  dot1x guest-vlan enable
  dot1x reauthentication
  dot1x radius-attributes vlan static
  dot1x port-control auto
  switchport mode general
  switchport general allowed vlan add 104 untagged
  no macro auto smartport
  !
  exit
  ip default-gateway 172.16.200.1
  

  Looks like there was a similar questions here, but it seems to have never been resolved:

  https://supportforums.Cisco.com/message/3336810#3336810

  Hi all

  I'm working with Colin and that ends up being a problem of RADIUS. In the file eap.conf, for peap (auth phase 1).

  We need to enable copy_request_to_tunnel AND use_tunneled_reply:

  {PEAP

  # The syringe EAP session needs a default value
  # Type of EAP that is distinct from that of
  # module EAP-tunneled.  Inside of the
  # PEAP tunnel, we recommend that you use MS-CHAPv2,
  # as the default type is supported by
  # Windows clients.
  default_eap_type = mschapv2

  # module has PEAP also of these configuration
  Articles of #, which are the same as TTLS.

  copy_request_to_tunnel = yes
  use_tunneled_reply = yes

  Subsequently, we could see the answers of the test with id user vlan posting it once by response.

  See you soon!

• Dynamic assignment of VLANS / SSID using the IAS 4402/MS

  Greetings,

  In short, we have a WLC4402 (50 AP license) and about 30 1252 s towers in place. At the moment we have three VLANS / SSID in place - one for admin, to teachers and students. The WLC uses a server for MS Windows 2003 running IAS for PEAP authentication. Windows XP, the SSID clients entered manually based on "prior designation" 'type' laptop (admin, teacher or student).

  It works very well. However more frequently our users were 'sharing' portable computers so a student can need to use his laptop computer and vice versa. In short, we would like to use the dynamic assignment of VLANS / SSID as well as if a student has the teacher, 'students' laptop VLAN / SSID would receive them when connect (and apply the appropriate ACL, QoS policies, etc.)

  We have found the documents on how to do that with a CBS, but is there something available for this configuration with a MS IAS server.

  All entry information would be greatly appreciated.

  Joe

  The installer works fine with the Server IAS Ms. You must set the options for RADIUS (3 of them) which are documented in the ACS similar article of the same ilk. You can have one SSID, using RADIUS authentication and have the Active Directory to determine the membership to a vlan based on the group.

  The RADIUS attribute parameters are

  Tunnel-Type = Vlan

  Tunnel-Pvt-Group-ID = vlanid

  Tunnel-Medium-Type = 802

  I also like to set

  Ignore-User-Dialin-Properties = True

  You must create some policies in IAS to match your windows groups and set the id vlan correct. A separate policy of IAS by vlan.

  Set the attributes RADIUS by political IAS and ad group or however you plan on the determination of the membership.

  If you want to use RADIUS for administration, you must also define a separate policy that defines the RADIUS of the Service Type administrative = attribute

  Jim

• Cisco ACS, multiple CA, assignment of VLAN relevant to the domain

  Hi all

  I searched for a solution to a specific customer requirement.

  I want authenticate users with certificates from different RootCA wireless and assign them to one VLAN based on their field?  Ideally, using the same SSID and a Cisco ACS server.

  Is this possible?  Has anyone seen that it works?

  I realize that the ACS can have trust company for the relevant RootCA (dunno what version is needed for this?).  And that assignment VLAN is also possible to a unique SSID based on RADIUS attributes.  But I am not sure that these parts would fit together?

  Would appreciate some advice!

  Thanks in advance

  Rob

  Hello

  Yes, this is possible. I suggest that you implement one by one to make sure that everything works, but no problem to do so. All recent versions of ACS allow this.

  You can do mapping group from ad groups (a group for each area, so if you want to) and assign the vlan based on the mapping of this group.

  GBA can trust several certification authorities and authenticate users with certificates of all these cases. It's just a matter of import these number certificate in the trust list.

  And you can assign the vlan and use only one ssid as well.

  I can't guide you on the procedure that it depends on which version you have and if you have IOS ap or WLC, but it is basically each function separated as in the config Guide and just used all together.

  Nicolas

  ===

  Remember responses of the rate that you find useful

• authetication affectedly 802.1 x Vlan dynamic by a radius server

  Hello

  At school, I want to start using authentication for 802. 1 x affectedly Vlan dynamic by Radius Windows Server 2012R2.

  When a student logs in, I want it to be placed in the Vlan 'Students', when an Administrative employee logs in, I want it to be placed in the vlan 'Administrative' and when the client is unknown, I want to place in the Vlan "invited".

  I have several SG200 switches and I have everything configured as described in the administrative guide but I can't make it work as you want.

  What does not work:
  -If the client is authorized, the switch enters the State "authorized". (until someone connects to the domain with this customer)
  -When a user opens a session which is part of the administrative staff, the switch becomes 'authorized' and when a student logs in, it turns into "unauthorized."

  So far so good.

  But what does not work:
  -It does not have the administrative employee in the Vlan 'Administrative', it allows the port of the switch comes, but he leaves in the vlan by default 1.
  -I can't find the VLAN comments.

  Any help would be appreciated.

  Hi Wouter,

  Yes you are right, 200 series doesn't support DVA. Only 300 or 500 have this level of the interface settings.

  Aleksandra

• 802. 1 x with assignment of VLANs

  Hello

  I'm trying to Setup 802. 1 x with assignment of VLANS. I have been successfully obtained the authentication works, but assigning VLAN is not applied. I tried this on a CE500, and WS2950-12 once encountering the same problem.

  If I "debug dot1x all the" I get a few messages "dot1x-ev: received VLAN Id - 1", if I'm capturing packets on my radius server, I see that the correct attribute pairs are extinguished. "." Nothing in the notes say that 802. 1 x with dynamic VLAN will not work.

  Attribute value pairs

  AVP: l = t = Framed-Protocol (7) 6: PPP (1)

  AVP: l = t = Service-Type (6) 6: Framed-User (2)

  AVP: l = t = Tunnel-Medium-Type (65) 6: Unknown (16777222)

  AVP: l = 5 t = Tunnel-Private-Group-Id (81) Tag = 0 x 01:20

  AVP: l = t = Tunnel-Type (64) 6: Unknown (16777229)

  AVP: l = 6 t = EAP - Message (79) last Segment [1]

  AVP: l = 46 t = Class (25): 53F9068C00000137000102000A011E630000000000000000...

  AVP: l = 14 t = Vendor-Specific (26) v = Microsoft (311)

  AVP: l = 51 t = Vendor-Specific (26) v = Microsoft (311)

  AVP: l = 58 t = Vendor-Specific (26) v = Microsoft (311)

  AVP: l = 58 t = Vendor-Specific (26) v = Microsoft (311)

  AVP: l = 18 t = Message-Authenticator (80): 33B53112C51B15C40BFBDCE687F4C9C4

  Please check if all 3 of these attributes are set correctly on the Radius Server:

  AVP: l = t = Tunnel-Medium-Type (65) 6: Unknown (16777222)

  AVP: l = 5 t = Tunnel-Private-Group-Id (81) Tag = 0 x 01:20

  AVP: l = t = Tunnel-Type (64) 6: Unknown (16777229)

  It seems that only the Tunnel-private-Group-Id is defined, not the other two.

  CFR. http://www.Cisco.com/en/us/Tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml

• ISE - assignment of VLAN 7.2 WLC

  Good evening

  The authorization of the Wireless_Employees profile, assign vlan 666 employees wireless.

  ISE is passing VLAN 666 to the WLC - see attachment Radius Auth - VLAN666.jpg

  When I look on the WLC to wireless employee who has connected to the network, successuflly WLC is him always place in the pre-settings 7 VLAN.

  1. can you VLAN be pushed of ISE to the WLC (code 7.2.103) for the specific user session?

  2. If so, suggestions, why it does not work for me.

  Thank you.

  Cath.

  Cath,

  Here's a guide that will help with dynamic assignment of VLANs on a WLC.

  http://www.Cisco.com/en/us/Tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml#WLC

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• Assignment of VLANS by MAC address on a 6248

  Hello

  We have a mixture of 5548 and 6248 switch batteries, all updated to the latest fw, grouped on a 8024f.

  We add 560 Polycom phones to our network and want to assign phones to the voice VLAN and use the internal switch on the phone to the computer workstation.

  The 5548 have the handy table YES, the:

  VLAN voice Yes-table add 00907 Polycom/Veritel_phone___

  It works a treat and the assignment of VLANS for phone and PC works beautifully on the 5548.

  However, the 6248 legacy does not have this feature.

  Am I right assuming that we cannot assign addresses MAC Polycom-issued to one VLAN specific on switches 62XX as 55XX switches on? We are left with assigning simply labeled the voice VLAN? I'm afraid non-voix tag traffic for some applications will be treated badly as voice.

  What is the best way to do it? Here are the General config we will stop for the 6248:

  Configure
  database of VLAN
  VLAN 10 100

  interface vlan 10
  name "VoIP."
  output

  interface vlan 100
  name 'data network '.
  Routing
  IP 10.1.10.1 255.255.255.0
  output

  Example config for a switchport with Polycom and PC phone
  !
  interface ethernet 1/g1
  switchport mode general
  switchport General pvid 100
  No switchport acceptable-framework-type general tag only
  VLAN allowed switchport General add 100
  switchport general allowed vlan add 10 tag
  switchport vlan allowed General remove 1
  output
  !

  The 6248 uses a Broadcom firmware and the 5548 uses a Marvell firmware, that's why we see the differences in the characteristics. The 6248 has no YES table as the 5548. Here is the basic configuration of VLAN voice on the 6248.

  1.

  To start creating a VLAN voice, create it first VLAN database mode for VLAN.

  Console # console (config) # vlan database console(config-vlan) # vlan 2 console (config - vlan) #exit console (config) #.

  2.

  Then, globally enable the Vlan voice.

  Console (config) # vlan VoIP

  3.

  In the configuration of interface for the desired port mode, assign it VLAN to the port using general mode. Then, assign it VLAN voice on the port with the command vlan vlan id #.

  Console (config) # interface console item in gi1/0/10 # switchport general console mode # vlan 2 voice

  There is also this white page that goes over the process.

  www.Dell.com/.../pwcnt_voice_VLAN_support.pdf

  A workstation sends no marked traffic, and will be placed on the general mode port PVID. In this case, it seems that your PVID is VLAN 100, therefore all workstation traffic will go to this VLAN. I'm not aware of a situation where the traffic of the workstation would be confused with traffic voice and placed on the VLAN incorrect, you have a specific situation / application where you think this can happen? I can do some research on this scenario to help alleviate any concerns.

  Thank you

• NPS server - only Wired VLAN dynamic - Windows 7 - currently no available connection server

  Hi all

  I have deployed an NPS (Server 2008 R2) server with users added to security groups and configured VLAN DYNAMIC for wired connections (LAN) configured on the switch.

  And the concept works fine if the user has already logged on. But if the new user or user ID are set not to cache the user ID won't be able to connect.

  "Currently no available connection server ' for Windows 7 clients.

  Changes in the local AREA NETWORK CONNECTION for as below for the settings of 802.1 X.

  Specify the authentication mode: auth user or computer.

  enable single sign on for this network

  run immediately before the opening of the session.

  Networks through VIRTUAL happen seamlessly once connected, but if the user of the switch or new user whose profile is not connected to the user gets "no server connection.

  Objective: Users must be able to connect with their powers even without caching credentails.

  Need suggestions or responses on that.

  Thank you

  Shashi Kumar G

  This issue is beyond the scope of this site (for consumers) and to be sure, you get the best (and fastest) reply, we have to ask either on Technet (for IT Pro) or MSDN (for developers)
  *
  http://social.technet.Microsoft.com/forums/en-us/home s/fr-U.S./Accueil
  http://social.msdn.Microsoft.com/Forum

• Authentication of 802. 1 X with the assignment problem VLAN.

  Hello

  I intend to implement the authentication of 802. 1 X with assignment of VLANS on our network and assign different VLAN on the switch (Cat2960) of access according to the terminals (for example, VLAN10 for VLAN40 for PC, VLA30 for STB IPTV, VLAN20 for voice, WLAN) after a successful authentication.

  Is the topology of the network (backbone L3 Switch: Cat6K) <----->(L2 access switch: Cat2960) <-------->(L2 access switch: Cat2960) <-->WLAN, voice, IPTV, PC. (Please refer to the file for the detailed topology rasthaus)

  I have to respect (switch L2) <-->(switch L2) topology due to wiring problem.

  My question is below.

  1. to take account of different VLAN of terminals, the only way is in trunk on both L2 switches port. is this possible?

  As far as I know, cannot enable 802. 1 X on a trunk port. is it good?

  2. If this is true, is there a solution?

  Thank you for your help. :-)

  You will not run 802. 1 x on the junction between switch ports, but rather on the ports that connect devices to end-users.