Network Management

Hi
I have noticed a issue that has not been happening previusly for us.
After enabling 802.1x on our switches some device types MAC-adress are no longer recognized on the interface, so if the device is not recognized it will not be allwoed to access our netwrok.
As soon as i remove 802.1x from the configuration the device MAC-adress is detected and device is working as it should.
This happens to Older printers,  solarpanel inverters and so on. New printers works.

Initially this happend for us on our new 6100 switches but now i'm having same issue on older 2530 switches.

On 2530 we have YA.16.11.0004
On 6100 aos-cx we have PL.10.10.1000

Our 802.1x config on 2530 switch is as follows:

radius-server host x.x.x.x key **************

aaa authentication port-access eap-radius

aaa authentication mac-based peap-mschapv2

aaa port-access authenticator active

aaa authentication mac-based chap-radius

aaa port-access authenticator 1-24

aaa port-access authenticator 1-24 client-limit 1

aaa port-access mac-based 1-24 unauth-vid ***

aaa port-access mac-based 1-24

aaa port-access mac-based 1-24 addr-limit

On 6100 model we have this config:

radius-server host x.x.x.x key plaintext ***********

aaa authentication port-access dot1x authenticator auth-method eap-radius

aaa authentication port-access mac-auth auth-method chap

aaa authentication port-access dot1x authenticator enable

aaa authentication port-access mac-auth enable

interface 1/1/1-1/1/48

Description client-port

No shutdown

port-access onboarding-method concurrent enable

aaa authentication port-access client-limit 1

aaa authentication port-access reject-role noauth

aaa authentication port-access dot1x authenticator

enable

aaa authentication port-access mac-auth

enable

Think you can best reach out to TAC. I would run a port mirror on the affected ports and see what happens there.
Note that you may need to bounce the switch port or restart the device if you enable the configuration because the mac authentication will only kick in when the device sends out a packet.

You have enabled concurrent onboarding, where otherwise that could be a recommendation to turn that on. Without that setting, it can be that the 802.1X authentication takes so long before mac authentication happens, that the device has given up and never send any packet anymore. But this shouldn't be the case with your config.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------