locked
NAP VLAN Assignment with Guest VLAN for non-802.1x clients RRS feed

  • Question

  • Hello,

    I'm trying to configure NAP in the following scenario:

    2 VLAN's to choose from (plus voice, but that's CDP assigned so no worries just yet).
    50 is Guest,  20 is Data.

    System is a 3845 using a NME-16ES switchport module.  RADIUS is configured on the switchport module.  Typical "Dynamic" port looks like this:

     interface FastEthernet1/0/1
     switchport access vlan 50
     switchport mode access
     switchport voice vlan 10
     dot1x pae authenticator
     dot1x port-control auto
     dot1x guest-vlan 50

    Issue is:

    802.1x NON compatible clients time out on EAPOL requests after about a minute.  Swich then opens the port for use but DHCP has already timed out meaning a manual ipconfig /renew.


    802.1x Compatible Clients that are domain members - works fine and go to either 20 or 50 depending on the NPS/healthcheck outcome.
    802.1x Compatible Clients that are not domain members go to guest VLAN by the swtich, as it's an access-reject reply from the RADIUS server, the DHCP doesn't time out early...

    All clients that are 802.1x compatible are Vista.

    Non 802.1x clients are guest machines - I cannot change the settings, DHCP registry settings etc at all on these.  They range from Vista to XP and possibly Linux.

    Any advice?
    Wednesday, September 3, 2008 8:23 PM

Answers

  •   Hello,

    DHCP is purely a client initiated protocol.  There is nothing on the switch or elsewhere in your network that can be used to initiate a client IP renewal.  For Windows XP and Vista, when the initial DHCP requests time out, we assign the computer an address in the 169.254.x.x (APIPA address) range.  However, the client will continue to send out DHCP discovers every three minutes for as long as the connection is up.  I can't speak for how a linux or mac client would behave, but i suspect it would be similar.
    Clay Seymour - MSFT
    Monday, September 8, 2008 1:10 AM