Hi everyone.
I've got a little problem with my authentication configuration on a powerconnect 5548.
I use the MAC adresses of my users to authenticate them and it works perfectly.
I decided to add dynamic vlan assignment, so when the users are identfied, they will be in the appropriate vlan.
But the problem is when a user is identified, he is in two vlans : the vlan where the user is supposed to be and the guest vlan that I configured 'cause the authentication doesn't work without it. But the user must be in only one vlan, not in the guest at the same time.
I read the CLI guide of the switch and it appears that user is in the guest vlan automatically after a successfull authentication.
Here is my switch's configuration :
SW5548# sh run
dot1x guest-vlan timeout 30
vlan database
vlan 10,20,30,40,50,60,70,80,90,100
exit
voice vlan oui-table add 000181 Nortel__________________
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 001049 Shoretel________________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00907a Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
dot1x system-auth-control
gvrp enable
iscsi target port 860 address 0.0.0.0
iscsi target port 3260 address 0.0.0.0
iscsi target port 9876 address 0.0.0.0
iscsi target port 20002 address 0.0.0.0
iscsi target port 20003 address 0.0.0.0
iscsi target port 25555 address 0.0.0.0
hostname SW5548
radius-server host 192.168.12.15 key test
aaa authentication enable default enable
aaa authentication login default radius
aaa authentication dot1x default radius
line telnet
password 6e949a9a71d9dfb6f903ac979dd79e07b39e4c3f encrypted
exit
enable password level 15 encrypted 6e949a9a71d9dfb6f903ac979dd79e07b39e4c3f
username adminsw password encrypted 6e949a9a71d9dfb6f903ac979dd79e07b39e4c3f
privilege 15
ip ssh server
!
interface vlan 40
ip address 192.168.12.20 255.255.255.0
dot1x guest-vlan
!
interface gigabitethernet1/0/1
dot1x max-req 5
dot1x timeout reauth-period 300
dot1x timeout server-timeout 5
switchport mode trunk
interface gigabitethernet1/0/3
dot1x host-mode multi-sessions
dot1x guest-vlan enable
dot1x reauthentication
dot1x mac-authentication mac-only
dot1x radius-attributes vlan
dot1x port-control auto
!
interface gigabitethernet1/0/4
switchport access vlan 100
!
interface gigabitethernet1/0/5
switchport access vlan 100
!
interface gigabitethernet1/0/6
switchport access vlan 100
!
interface gigabitethernet1/0/7
switchport access vlan 100
The other interfaces have the same configuration.
Here is my radius users file configuration :
"0019b91e0b42 Cleartext-Password := "0019b91e0b42"
Service-Type = Framed-User,
Tunnel-type = VLAN,
Tunnel-Medium-Type = IEEE-802,
Tunnel-private-Group-ID = 20"
My questions are :
-Is that a problem that users are in the guest vlan?
-Can I put my users in only one vlan or at least not in the guest-vlan ?
-Where is the problem ?
Thank you very much for your help.