Hi,
I am working on a setup where i have 6560 switches and clearpass Radius server.
Requirement is ... If any external user connects to switch, which is non-domain joined & not authenticated. User should get Limited role where we have configured limited access using QOS Allowed OR Blocked network groups. But users are getting full access vlan IP from default profile which is configured in unp-port template. UNP configuration snapshot is attached.
Currently we configured 2 roles in QOS i.e. Full and Limited.
When we connect any external user (which is non-domain joined & not authenticated) to switch, clearpass is pushing Limited role, Limited role is configured in clearpass as a filter-id. User should get Limited role where we have configured limited access using QOS Allowed OR Blocked network groups. When clearpass changes the role of user to Limited, switch is not changing the role. In limited role, we have restricted some IP addresses. When switch does not change the role in switches, In result, all external users are getting full access to the network.
In clearpass access tracker, this user is getting rejected because that user is not domain-joined and not authenticated by authenticated source. Clearpass is also pushing "Limited" filter-id which is configured in policy list of qos.
Here is the QOS configuration attached for your kind review...
Please check and help in fixing the issue. QOS and UNP config are shown below.
-----------------------------------------------------
unp profile "voip-temp"
unp profile "users-temp"
unp profile "users-temp1"
unp profile "Quarantine VLAN"
unp profile "voip-temp" map vlan 12
unp profile "users-temp" map vlan 212
unp profile "users-temp1" map vlan 112
unp profile "Quarantine VLAN" map vlan 56
unp port-template Port-CP redirect-port-bounce direction both default-profile "users-temp" classification trust-tag ap-mode admin-state enable
unp port-template Port-CP 802.1x-authentication
unp port-template Port-CP 802.1x-authentication tx-period 60 supp-timeout 10
unp port-template Port-CP mac-authentication
unp port-template Port-Mobile redirect-port-bounce direction both default-profile "users-temp1" classification trust-tag ap-mode admin-state enable
unp port-template Port-Mobile 802.1x-authentication
unp port-template Port-Mobile 802.1x-authentication tx-period 60 supp-timeout 10
unp port-template Port-Mobile mac-authentication
unp port-template Port-Mobile force-l3-learning port-bounce
unp port 1/1/4 port-type bridge
unp port 1/1/4 port-template Port-CP
unp classification mac-range 10ae:00:00:00 10ae:ff:ff:ff profile2 "voip-temp"
-----------------------------------------------------
! QOS:
policy service DHCP destination udp-port 67-68
policy service DNS destination udp-port 53
policy service HTTP destination tcp-port 80
policy service HTTPS destination tcp-port 443
policy service group Basic DHCP DNS HTTP HTTPS
policy network group Allowed 12.0.0.5 192.168.100.120 192.168.100.121 192.168.100.122 192.168.112.4
policy network group Allowed 192.168.112.6 192.168.112.57 192.168.112.58 192.168.112.59
policy network group Blocked 192.168.112.9 192.168.112.10 192.168.112.11 192.168.112.12 192.168.112.13
policy network group Blocked 192.168.112.15 192.168.112.16 192.168.112.17 192.168.112.21 192.168.112.30
policy network group Blocked 192.168.112.36 192.168.112.39 192.168.112.42
policy condition Full source ip Any destination ip Any
policy condition Limited destination network group Allowed service group Basic
policy condition Limited_Deny destination network group Blocked
policy action Full
policy action Limited
policy action Limited_Deny disposition deny
policy rule Full precedence 500 condition Full action Full
policy rule Limited precedence 400 condition Limited action Limited
policy rule Limited_Deny precedence 200 condition Limited_Deny action Limited_Deny
policy list Full type unp
policy list Full rules Full
policy list Limited type unp
policy list Limited rules Limited Limited_Deny
qos apply
--------------------------------------------------------------
Urgent - Using 802.1x with UNP and QOS
-
- Member
- Posts: 26
- Joined: 03 Jun 2016 15:04
Jump to
- General topics
- ↳ Talk to the admins
- ↳ GENERAL
- ↳ Outside World
- ↳ PARTS
- ↳ Pre-Sales
- ↳ JOBS
- ↳ Remote assistance contracts
- ↳ Actis
- ↳ Equipement Pictures
- ↳ OT/OXE/OXO FEATURES REQUESTS
- ↳ Lucent Technologies
- IF YOU ARE NOT TECHNICALLY TRAINED ON THOSE PBX, PLEASE POST IN ONE OF THOSE FORUMS
- ↳ Beginner's questions about the Crystal Hardware
- ↳ Beginner's questions about the Common Hardware
- ↳ Beginner's questions about the (4400 / Enterprise) PHONE APPLICATION or OPERATING SYSTEM
- ↳ Beginner's questions about the OmniPCX OFFICE
- VOICE - Documentation
- ↳ OXE (Crystal / Common) - System Documentation
- ↳ 4760
- ↳ OXO - System Documentation
- ↳ Documentation
- VOICE - OXE (OmniPCX Enterprise)
- ↳ Shelf
- ↳ Media Gateway
- ↳ PWT/DECT System
- ↳ System
- ↳ Translator
- ↳ Classes of Services
- ↳ Attendant
- ↳ Users
- ↳ Users by profile
- ↳ Set Profile
- ↳ Groups
- ↳ Speed Dialing
- ↳ Phone Book
- ↳ Entities
- ↳ Trunk Groups
- ↳ External Services
- ↳ Inter-Node Links
- ↳ X25
- ↳ Data
- ↳ Application
- ↳ Specific Telephone Services
- ↳ ATM
- ↳ Event Routing Discriminator
- ↳ Security and Access Control
- ↳ IP
- ↳ SIP
- ↳ DHCP Configuration
- ↳ Alcatel-Lucent Series 8&9
- ↳ SIP Extension
- ↳ Encryption
- ↳ Passive Communication Server
- ↳ SNMP Configuration
- VOICE - OXE - Common topics
- ↳ MAIN
- ↳ ACTIS
- ↳ Asterisk
- ↳ Boards
- ↳ Bugs & Security issues
- ↳ Equipment Pictures
- ↳ Feature Request
- ↳ H323 / Sip
- ↳ IP / VoIP
- ↳ IP SECURITY / ENCRYPTION (Thales)
- ↳ ipTouch (40x8) issues and tricks
- ↳ Linux tricks
- ↳ MOH
- ↳ ON SITE TROUBLES
- ↳ Phones
- ↳ Sipfoundry
- ↳ Software Loading
- ↳ Swinst
- ↳ System Hacking
- ↳ Traces
- ↳ Usefull commands
- ↳ Voice Guides
- ↳ VMWARE
- ↳ Wireless configuration and sets
- VOICE - OpenTouch
- ↳ MAIN
- ↳ OTEC - OpenTouch Enterprise Cloud
- ↳ OTBE - OpenTouch Business Edition
- ↳ OTMS - OpenTouch Multimedia Services
- ↳ OTSBC - OpenTouch Session Border Controller
- ↳ OTNS - OpenTouch Notification Service
- ↳ OTMC - OpenTouch Message Center
- ↳ OTFC - OpenTouch Fax Center
- ↳ OpenTouch Conversation
- ↳ Smart Guest Applications
- VOICE - BiCS
- ↳ MAIN
- VOICE - OXO
- ↳ MAIN
- ↳ Configuration
- ↳ 42xx Systems
- ↳ Networking
- ↳ H323 / IP / Pimphony
- ↳ Internet and related
- ↳ Applications
- ↳ Hotel mode
- ↳ DECT
- ↳ Hardware
- VOICE - Omni Suite
- ↳ OmniTouch 8400 Instant Communication Suite
- ↳ OmniTouch 8410 Instant Communication Web Services
- ↳ OmniTouch 8440 Messaging Software
- ↳ OmniTouch 8450 Fax Software
- ↳ OmniTouch 8460 Advanced Communication Server
- ↳ OmniTouch 8464 Meet-me Audio Conference Bridge
- ↳ OmniTouch 8660 My Teamwork Conferencing and Collaboration
- ↳ OmniTouch 8670 Automated Message Delivery System
- ↳ OmniTouch Contact Center Standard Edition
- ↳ OmniTouch Contact Center Premium Edition
- VOICE - Applications
- ↳ AECS - Alcatel Extended Communication Server
- ↳ Alcatel OpenTouch Customer Service
- ↳ Aviso
- ↳ Call Center SoftPanel (ALU ProServices)
- ↳ CCD / CCS / CCIVR
- ↳ Free Desktop
- ↳ GENESYS
- ↳ Hotel / Hospital
- ↳ Ip Desktop Softphone
- ↳ IpTouch Phones XML Applications
- ↳ MSAD
- ↳ MyIC (My Instant Communicator)
- ↳ My Messaging / IMAP
- ↳ My Teamwork (ex-eDial)
- ↳ OmniPCX Record
- ↳ OmniVista 4760
- ↳ OmniVista 8770
- ↳ OTUC
- ↳ PREMIUM / GCE
- ↳ Rainbow
- ↳ Ubiquity
- ↳ ENS - Emergency Notification Server
- ↳ VNA - Visual Notification Assistant
- ↳ VAA - Visual Auto Attendant
- ↳ VitalSuite
- ↳ VitalQIP
- ↳ Voicemail (46x5)
- ↳ XML Presentation Server & TAPI Server
- ↳ 4980 - WebSoftPhone
- ↳ 4625 Interactive Voice Response
- VOICE - Third Party Applications
- ↳ AGITO NETWORKS
- ↳ AUDIOCODES
- ↳ ASTERISK
- ↳ AVST
- ↳ CISCO
- ↳ NGINX
- ↳ NICE
- ↳ Notification Systems
- ↳ OAK
- ↳ SOURCE TECH
- ↳ systel
- ↳ IP Touch apps
- ↳ Click2Dial
- ↳ MYIC apps
- Alcatel Unleashed tools, documentations, and misc files...
- ↳ DIALER
- ↳ VM_BACKUP
- ↳ ipview analyzer
- ↳ "Home Made" documentations
- ↳ Alcatel Misc Documentation
- ↳ infocollect
- ↳ motview
- ↳ Other Alcatel-Lucent tools
- ↳ OFFICIAL TC's
- ↳ sngrep
- Developer's corner
- ↳ AHL / OHL
- ↳ Alarming, Notification & Location
- ↳ CCTI / CCA
- ↳ CSTA
- ↳ My IC Phone
- ↳ My IP Touch Service for Enterprise
- ↳ O2G
- ↳ OmniVista 8770 User Provisioning
- ↳ SIP
- ↳ TAPI
- ↳ TSAPI
- ↳ Web Services
- Alcatel Data Equipment
- ↳ Security
- ↳ OmniAccess 3500 Nonstop Laptop Guardian
- ↳ Mobility
- ↳ OmniAccess WLAN Switching Systems
- ↳ OmniAccess WLAN 4302
- ↳ OmniAccess Wireless Access Points 41
- ↳ OmniAccess Wireless Access Points 65
- ↳ OmniAccess Wireless Access Points 60/61/70
- ↳ OmniAccess Wireless Access Points 80M
- ↳ Mobile IP Phones
- ↳ OmniAccess Devices
- ↳ OmniAccess 5780
- ↳ OmniAccess 5740
- ↳ OmniAccess 5510
- ↳ Network Management
- ↳ Omnivista
- ↳ Omnivista Mobility Manager
- DATA - Documentation
- ↳ Technical papers
- ↳ Troubleshooting guides
- DATA - Lan Switching
- ↳ OmniSwitch 10k
- ↳ OmniSwitch 9900
- ↳ OmniSwitch 9000 / 9000E
- ↳ OmniSwitch 6900
- ↳ OmniSwitch 6865
- ↳ OmniSwitch 6860 / 6860E
- ↳ OmniSwitch 6855
- ↳ OmniSwitch 6850 / 6850E
- ↳ OmniSwitch 6560
- ↳ OmniSwitch 6465
- ↳ OmniSwitch 6450
- ↳ OmniSwitch 6400
- ↳ OmniSwitch 6360
- ↳ OmniSwitch 6350
- ↳ OmniSwitch 6250
- ↳ OmniSwitch 2220
- ↳ OmniSwitch 2260 / 2360
- ↳ Legacy Devices (OS4024, XOS, OmniCore)
- ↳ OmniSwitch 6600 / 7000 / 8800
- ↳ OmniSwitch 6800
- ↳ OmniStack LS 6200
- ↳ Misc
- DATA - WLAN, Mobility and WAN
- ↳ OmniAccess WLAN Switching Systems (OEM)
- ↳ OmniAccess Wireless Access Points
- ↳ Mobile IPTouch Phones (MIPT)
- ↳ OmniAccess Stellar Express
- ↳ OmniAccess Stellar Enterprise
- ↳ OmniAccess 3500 Nonstop Laptop Guardian
- ↳ Brick VPN Firewall
- ↳ OmniAccess 5740/5780
- ↳ OmniAccess ESR 5720
- ↳ OmniAccess 5510
- DATA - Network Management
- ↳ OmniVIsta 3600 Air Manager
- ↳ OmniVista 2500 v4.x
- ↳ OmniVista 2500 v3.5
- ↳ OmniVista 2500/2700 v3.4 and older
- ↳ OmniVista Cirrus
- ↳ Alcatel Quarantine Manager
- ↳ Fortigate Security
- DATA - Service Provider
- ↳ 5520 ASAM
- ↳ 5620 SAM
- ↳ 5650 CPAM
- ↳ 5670 RAM
- ↳ 5750 SSC
- ↳ 7210 SAS
- ↳ 7360 ISAM
- ↳ 7450 ESS
- ↳ 7450 Ethernet Service Switch
- ↳ 7750 Service Router
- ↳ 7705 SAR
- ↳ 7750 SR