Instant On - Wireless

Hi Ash.

Depend on your RADIUS server. When you know the client, for example via username or some other attribute, you then just send IETF attributes for vlan the client is belong to.

Best, Gorazd

Best, Gorazd

Hi Gorazd, 

That isn't the instant on portal.... https://portal.instant-on.hpe.com/ looks like you might be on the aruba portal not instant on portal. Apparently this isn't possible with the instant on portal? If you can confirm?

Hi Ash.

Depend on your RADIUS server. When you know the client, for example via username or some other attribute, you then just send IETF attributes for vlan the client is belong to.

Best, Gorazd

Best, Gorazd

This is Clearpass. ION portal does not have NAC capabilities. You need to have your own RADIUS server to implement this. What I posted are RADIUS attributes you need to return in response message to EAP RADIUS request along with Accept status. Standard RADIUS stuff. You can use Freeradius if you don't have any other RADIUS available.

Best, Gorazd 

Hi Gorazd, 

That isn't the instant on portal.... https://portal.instant-on.hpe.com/ looks like you might be on the aruba portal not instant on portal. Apparently this isn't possible with the instant on portal? If you can confirm?

Hi Ash.

Depend on your RADIUS server. When you know the client, for example via username or some other attribute, you then just send IETF attributes for vlan the client is belong to.

Best, Gorazd

Best, Gorazd

Hi Gorazd, 

I did try this with Freeradius. However when entering the credentials it wouldn't allow me to join a VLAN even setting the correct parameter's to pass. That's why I didn't think the instant on AP22 supported this?

This is Clearpass. ION portal does not have NAC capabilities. You need to have your own RADIUS server to implement this. What I posted are RADIUS attributes you need to return in response message to EAP RADIUS request along with Accept status. Standard RADIUS stuff. You can use Freeradius if you don't have any other RADIUS available.

Best, Gorazd 

Hi Gorazd, 

That isn't the instant on portal.... https://portal.instant-on.hpe.com/ looks like you might be on the aruba portal not instant on portal. Apparently this isn't possible with the instant on portal? If you can confirm?

Hi Ash.

Depend on your RADIUS server. When you know the client, for example via username or some other attribute, you then just send IETF attributes for vlan the client is belong to.

Best, Gorazd

Best, Gorazd

Hi Ash.

I test it on AP11, AP22, AP25 and AP32 without any problems using Clearpass.  I suppose you have all required VLANs tagged on switch port where AP is connected.

Do not forget Avenda-Tag-Id. You need to import Avenda Radius dictionary to Freeradius if you didn't do it yet.

Best, Gorazd

Hi Gorazd, 

I did try this with Freeradius. However when entering the credentials it wouldn't allow me to join a VLAN even setting the correct parameter's to pass. That's why I didn't think the instant on AP22 supported this?

This is Clearpass. ION portal does not have NAC capabilities. You need to have your own RADIUS server to implement this. What I posted are RADIUS attributes you need to return in response message to EAP RADIUS request along with Accept status. Standard RADIUS stuff. You can use Freeradius if you don't have any other RADIUS available.

Best, Gorazd 

Hi Gorazd, 

That isn't the instant on portal.... https://portal.instant-on.hpe.com/ looks like you might be on the aruba portal not instant on portal. Apparently this isn't possible with the instant on portal? If you can confirm?

Hi Ash.

Depend on your RADIUS server. When you know the client, for example via username or some other attribute, you then just send IETF attributes for vlan the client is belong to.

Best, Gorazd

Best, Gorazd

Thanks interesting. Everyone I spoke to said it's not possible. Are you able to provide me a full set of setup instructions? 

Hi Ash.

I test it on AP11, AP22, AP25 and AP32 without any problems using Clearpass.  I suppose you have all required VLANs tagged on switch port where AP is connected.

Do not forget Avenda-Tag-Id. You need to import Avenda Radius dictionary to Freeradius if you didn't do it yet.

Best, Gorazd

Hi Gorazd, 

I did try this with Freeradius. However when entering the credentials it wouldn't allow me to join a VLAN even setting the correct parameter's to pass. That's why I didn't think the instant on AP22 supported this?

This is Clearpass. ION portal does not have NAC capabilities. You need to have your own RADIUS server to implement this. What I posted are RADIUS attributes you need to return in response message to EAP RADIUS request along with Accept status. Standard RADIUS stuff. You can use Freeradius if you don't have any other RADIUS available.

Best, Gorazd 

Hi Gorazd, 

That isn't the instant on portal.... https://portal.instant-on.hpe.com/ looks like you might be on the aruba portal not instant on portal. Apparently this isn't possible with the instant on portal? If you can confirm?

Hi Ash.

Depend on your RADIUS server. When you know the client, for example via username or some other attribute, you then just send IETF attributes for vlan the client is belong to.

Best, Gorazd

Best, Gorazd

Ok. Just tested again. There are some nuisance but in principle it works.

Create RADIUS server profile.

Create a new network with security WPA2 Enterprise or WPA2 + WPA3 Enterprise and select created RADIUS server profile..

Keep IP Addressing as "Same as Local Network"

And this is it. You need to return following RADIUS attributes. Tunnel-Private-Group-Id is the vlan number.

Switch port where AP is connected need to have tagged all vlans you will use.  And RADIUS server need to be on management vlan or accessible from management vlan.

What I find out, and it's not expected, and it is different from 2.x version. is this. In my testing only first authentication goes to RADIUS server. Subsequent authentications are cashed on AP and are not seen ba RADIUS. 

Best, Gorazd

Thanks interesting. Everyone I spoke to said it's not possible. Are you able to provide me a full set of setup instructions? 

Hi Ash.

I test it on AP11, AP22, AP25 and AP32 without any problems using Clearpass.  I suppose you have all required VLANs tagged on switch port where AP is connected.

Do not forget Avenda-Tag-Id. You need to import Avenda Radius dictionary to Freeradius if you didn't do it yet.

Best, Gorazd

Hi Gorazd, 

I did try this with Freeradius. However when entering the credentials it wouldn't allow me to join a VLAN even setting the correct parameter's to pass. That's why I didn't think the instant on AP22 supported this?

This is Clearpass. ION portal does not have NAC capabilities. You need to have your own RADIUS server to implement this. What I posted are RADIUS attributes you need to return in response message to EAP RADIUS request along with Accept status. Standard RADIUS stuff. You can use Freeradius if you don't have any other RADIUS available.

Best, Gorazd 

Hi Gorazd, 

That isn't the instant on portal.... https://portal.instant-on.hpe.com/ looks like you might be on the aruba portal not instant on portal. Apparently this isn't possible with the instant on portal? If you can confirm?

Hi Ash.

Depend on your RADIUS server. When you know the client, for example via username or some other attribute, you then just send IETF attributes for vlan the client is belong to.

Best, Gorazd

Best, Gorazd