Unsolved
1 Rookie
•
1 Message
0
69
S4148T switches and 802.1x authentication
Hello,
I've been trying to configure a S4148T-ON PowerSwitch to authenticate our clients and although the access control part is working fine, I couldn´t make the switch dynamically configure the correct VLAN on an authenticated port.
What I've observed so far tells me that the switch ignores the attributes Tunnel-Type, Tunnel-Private-Group-ID, and Tunnel-Medium-Type present on the Access-Accept message sent by the Radius server and simply controls the traffic for the VLANs already defined on the port configuration.
Could someone possibly tell me whether the S4148T supports VLAN configuration through 802.1x?
Thank you in advance.
Anderson
DELL-Chris H
Moderator
Moderator
•
8.8K Posts
1
April 17th, 2024 20:15
AndersonFerreira,
Unfortunately I am not seeing anything that suggests that we support the features to do so. Let me research it some more to confirm, but from what I see we wouldn't support it.
Praveen.Singh
3 Apprentice
3 Apprentice
•
415 Posts
0
April 24th, 2024 13:54
Verify that your switch firmware version supports dynamic VLAN assignment through 802.1x. Sometimes, certain firmware versions might have limitations or bugs related to specific features.
Ensure that the RADIUS server is configured to send the correct attributes (Tunnel-Type, Tunnel-Private-Group-ID, Tunnel-Medium-Type) in the Access-Accept messages. These attributes are crucial for the switch to dynamically assign VLANs based on user authentication.
JoeVsVolcano
1 Rookie
1 Rookie
•
1 Message
0
May 2nd, 2024 17:44
I'm testing the same Radius feature against a Dell N15xx.
In Switching/NetSec/PortSec section my port is set to 'locked'
In Switching/NetSec/Dot1x Auth/Auth I've assigned 'Guest VLAN' and 'Unauthenticated VLAN' numbers
I can confirm that no matter what I put in those radius fields(Tunnel-Type, Tunnel-Private-Group-ID, Tunnel-Medium-Type), the Dell only knows Guest or Unauthenticated.
my radius uses Winbind and my post auth section looks something like this
if (`/usr/bin/wbinfo --user-groups %{User-Name}` =~ /69/) {
update reply {
Tunnel-Type = VLAN
Tunnel-Medium-Type = IEEE-802
Tunnel-Private-Group-Id = 69
}
}
If it's possible, I'd also be interested in dynamic vlan assignment via Radius Auth..
(edited)