howto assign a port to a VLAN ip based

[champagnierle]

Hi,
we want to assign ports for printers IP based to the right vlan.
In R7 this was quite easy.
In R8 I'm trying to follow the tutorial on alu4u .
But it looks much easier than it is.

The concrete use case would be to assign all ports with source ip 192.168.140.0/24 to vlan 40.

In theory I figured out

unp port 1/1/14
unp edge_profile "printer vlan"
unp vlan-mapping edge-profile "printer vlan" vlan 40
unp classification ip-address 192.168.140.0 mask 255.255.255.0 "printer vlan"

but this is only fiction :-/

Can you please help me how to implement this on 6360 and 6560?

Thanks in advance

Marc

[Engan]

We need to know how your authentication is setup. Are you even using authentication? Run below commands and paste result here.

show configuration snapshot da-unp
show configuration snapshot aaa

[Engan]

If you are not using authentication:

vlan 40 name "Printers"
vlan 40 admin-state enable
!
vlan 40 members port 1/1/14 untagged (access port to printer)
vlan 40 members port 1/1/49 tagged (trunk / uplink port)

[Cristek]

This is definitely different from previous versions. You can find quite a few examples on these forums, but something like this will get you started:

Code: Select all

unp profile 'guest'
unp profile 'admin'
unp profile 'cctv'
unp profile 'voip'
unp profile 'guest' map vlan 10
unp profile 'admin' map vlan 20
unp profile 'cctv' map vlan 30
unp profile 'voip' map vlan 40

Code: Select all

unp classification mac-oui 20:20:20 profile1 'admin'
unp classification ip-address 192.168.20.0 mask 255.255.255.0 profile1 'admin'
unp classification mac-range 30:30:30:00:00:00 30:30:30:FF:FF:FF profile1 'cctv'
unp classification ip-address 192.168.30.0 mask 255.255.255.0 profile1 'cctv'
unp classification mac-address 40:40:40:40:40:40 profile1 'voip'
unp classification lldp med-endpoint ip-phone profile1 'voip'

Code: Select all

unp port-template 'my-template' default-profile 'guest' classification
unp port 1/1/1-10 port-type bridge
unp port 1/1/1-10 port-template 'my-template'

So with this config, by default you are always assigned to the Guest vlan automatically in case you don't get classified anywhere.
Then, if a device falls under a specific classification rule, that device will be assigned to that vlan (unp profile) instead.
You only asked for IP based assignment, but you can understand this example better.
Priority for the classification is: the switch checks MAC rules first, then LLDP, then IP (and there's more options here not just these 3).
Also, if you are using IP classification, ensure all those printers (and PCs, etc) have a static IP assigned and are not DHCP clients to not run into problems.