Configuration example 2

• In this example, PCs are connected to a meeting room 2615 switch series, which is connected to a switch (Local MAC authentication happens here). In addition:

  • Authentication of the 2615, example MAC is 00:10:80:* and it should end up in VLAN 15 tagged (management traffic)

  • Corporate PC MAC is: 002622bba7ac, and it should end up in VLAN 2 (Notebook of network administrator)

  • Rest of the corporate PC Series MAC is: 002622bb* and 00:26:22:bc:*, and it should end up in VLAN 3

  • Guest PCs: unknown MAC, and it should end up in Guest VLAN 99

  • Corporate IP Phones, example MAC: 00:80:11:*, and it should end up in VLAN 5 tagged

  • WLAN APs, example MAC: 00:80:12:*, and it should end up in VLAN 10 untagged, 12-14 tagged (10 management, 12-14 SSIDs with local break-out)

For further authentication of any OUIs, predefined in SwitchOS, group default is not allowed.

1. Create 5 LMA profilesThere is no need to create profiles for Guest PCs as you don’t know the MACs. Configure unauth-vid (explained in step 3 below) so that such a client fails the authentication and is put into guest VLAN.

   
   aaa port-access local-mac profile “corp-switch-prof” vlan tagged 15
   

   (for 2615 switches)

   
   aaa port-access local-mac profile “corp-pc-prof” vlan untagged 2
   

   (for corporate PCs)

   
   aaa port-access local-mac profile “rest-pc-prof” vlan untagged 3
   

   (for the rest of corporate PCs)

   
   aaa port-access local-mac profile “corp-phone-prof” vlan tagged 5
   

    (for corporate ip phones)

   
   aaa port-access local-mac profile “wlan-ap-prof” vlan untagged 10 tagged 12-14
   

   (for WLAN APs)
2. Associate MACs to these profiles

   
   aaa port-ac local-mac apply profile corp-switch-prof mac-oui 001080
   

   
   aaa port-ac local-mac apply profile corp-pc-prof mac-addr   002622bba7ac
   

   
   aaa port-ac local-mac apply profile rest-pc-prof mac-mask 002622bb/32  mac-mask  002622bc/32
   

   
   aaa port-ac local-mac apply profile corp-phone-prof mac-oui  008011
   

   
   aaa port-ac local-mac apply profile “wlan-ap-prof” mac-oui 008012
   

3. Configure guest VLAN

   
   aaa port-ac local-mac <ports> unauth-vid 99
   

4. Enable LMA on ports

   
   aaa port-ac local-mac <ports>