supported 802.1x 3Com switches

[akajoe_]

Hi, would like to check where can have the list of supported/compatible 3com switches with Juniper UAC. I only managed to find out that 3Com Superstack 4400 with version rev 4.51S is supported.

Thanks

[Rabbit_]

Hi Joe,

At this time we have only QA'd 802.1x with the Superstack 4400 and the stated build of firmware. That being said, UAC should function just fine in any environment that is following the 802.1x standard.

Regards,

Rich

[Azaben_]

Hi All,

Im trying to configure 802.1x auth. on our 3com 5500 switches with no luck, even the vendor support was unable to help us on this, I wonder if anyone can provide me with the needed the commands?

Many thanks in advance,

[Raveen_]

Hi Azaben,

Below configuration I got it from internet, I haven't tested but it should work, make sure you're running the latest software version 3.3.2p19 or above.

------------------------------------------------------------------------

 domain default enable yourdomain
 port-security enable

 dot1x authentication-method eap
 undo dot1x handshake enable

 MAC-authentication domain yourdomain
 MAC-authentication authmode usernamefixed
 MAC-authentication authusername yourmacauthusername
 MAC-authentication authpassword somesecret

radius scheme yourscheme
 server-type extended
 primary authentication 192.168.0.1
 primary accounting 192.168.0.1
 accounting optional
 key authentication somesecret
 key accounting somesecret
 calling-station-id mode mode2 uppercase

domain yourdomain
 scheme radius-scheme yourscheme
 accounting radius-scheme yourscheme
 vlan-assignment-mode vlan-list

interface Ethernet1/0/1
 stp edged-port enable
 port link-type hybrid
 port hybrid vlan 3 untagged
 undo port hybrid vlan 1
 port hybrid pvid vlan 3
 broadcast-suppression pps 3000
 port-security max-mac-count 1
 port-security port-mode userlogin-secure-or-mac
 port-security guest-vlan 3
 dot1x max-user 1
 MAC-authentication max-auth-num 1

------------------------------------------------------------

Note: If I have answered your question right, you could mark this post as accepted solution, that way, it helps others as well. Kudos will be bonus thanks!!

Regards,

Raveen

[Raveen_]

Hi Azaben,

Below configuration I got it from internet, I haven't tested but it should work, make sure you're running the latest software version 3.3.2p19 or above.

------------------------------------------------------------------------

 domain default enable yourdomain
 port-security enable

 dot1x authentication-method eap
 undo dot1x handshake enable

 MAC-authentication domain yourdomain
 MAC-authentication authmode usernamefixed
 MAC-authentication authusername yourmacauthusername
 MAC-authentication authpassword somesecret

radius scheme yourscheme
 server-type extended
 primary authentication 192.168.0.1
 primary accounting 192.168.0.1
 accounting optional
 key authentication somesecret
 key accounting somesecret
 calling-station-id mode mode2 uppercase

domain yourdomain
 scheme radius-scheme yourscheme
 accounting radius-scheme yourscheme
 vlan-assignment-mode vlan-list

interface Ethernet1/0/1
 stp edged-port enable
 port link-type hybrid
 port hybrid vlan 3 untagged
 undo port hybrid vlan 1
 port hybrid pvid vlan 3
 broadcast-suppression pps 3000
 port-security max-mac-count 1
 port-security port-mode userlogin-secure-or-mac
 port-security guest-vlan 3
 dot1x max-user 1
 MAC-authentication max-auth-num 1

------------------------------------------------------------

Note: If I have answered your question right, you could mark this post as accepted solution, that way, it helps others as well. Kudos will be bonus thanks!!

Regards,

Raveen

[Azaben_]

Thanks a lot Raveen,

i checked the commands you sent, but i did not notice any nas-ip command that will specify the RADIUS server ip address, can you please send me the link you got the commands from,

many thanks in advance,

Regards,

Azaben

[Raveen_]

Hi

From the snippet that I sent earlier, you cna find below parameter which denotes the server IP(in your case UAC),

primary authentication 192.168.0.1

Regards,

Raveen

[Raveen_]

Hi,

domain default enable testlab-domain
#
dot1x
dot1x retry 10
dot1x timer handshake-period 1024
dot1x retry-version-max 10
dot1x dhcp-launch
dot1x authentication-method eap
#
radius scheme system
radius scheme testlab-scheme
server-type extended
primary authentication xxx.xxx.xxx.xxx (IC IP)
accounting optional
key authentication "Radius_secret"
nas-ip xxx.xxx.xxx.xxx  (local IP)

#
domain system
domain testlab-domain
scheme radius-scheme testlab-scheme
authentication radius-scheme testlab-scheme
vlan-assignment-mode string

Hope this helps!

Regards,

Raveen

Note: If I have answered your question right, you could mark this as acceptes solution, that way it would help others as well. Kudos will be bonus thanks!

[Azaben_]

Hi Raveen,

Thanks a lot, were you able to test those commands?

what is the coomands need to be configured on the interface (port)?

thanks again,

Regards,

[Raveen_]

Hi

I did not test it, but it is tested by someone else and it read to be working for them!

interface Ethernet1/0/1

 stp edged-port enable
 port link-type hybrid
 port hybrid vlan 3 untagged
 undo port hybrid vlan 1
 port hybrid pvid vlan 3
 broadcast-suppression pps 3000
 port-security max-mac-count 1
 port-security port-mode userlogin-secure-or-mac
 port-security guest-vlan 3
 dot1x max-user 1
 MAC-authentication max-auth-num 1

Regards,

Raveen

[Azaben_]

Hi Raveen,

I receive error when executing some commands as below, could you please advise.

[5500-SW-Ethernet1/0/21]   dot1x

Port Ethernet1/0/21 has set port-mode for port-security, can not support this operation.

[5500-SW-Ethernet1/0/21]  dot1x port-method portbased

Port Ethernet1/0/21 has set port-mode for port-security, can not support this operation.

[5500-SW-Ethernet1/0/21]  dot1x guest-vlan 240

Ethernet1/0/21: Guest vlan is only supported on portbased mode.

Regards,