Wired 802.1X and MAB with RADIUS VLAN assignment
Turn on port-based authentication on an access switch: staff log in with 802.1X, the printer gets in by MAB, and anyone else lands in a guest VLAN, each placed in a VLAN chosen by the RADIUS server.
Scenario
SW1's user ports Fa0/1-3 are open to anyone in VLAN 30. Lock them down. The RADIUS server ISE (10.99.99.10, Fa0/24) already lists SW1 (10.99.99.2) as a network device with the shared secret Cisco!Rad, holds user alice (group STAFF) and the printer PRN1's MAC address (group PRINTERS), and its rules send STAFF to VLAN 10 and PRINTERS to VLAN 20. Point SW1 at ISE, enable 802.1X with MAB as a fallback, accept the VLANs ISE assigns, and put devices that cannot authenticate in guest VLAN 30. PC1 is already set up to log in as alice.
Your tasks
- SW1 runs AAA with RADIUS server ISE in a server group, uses that group for the default dot1x and network-authorization method lists, and has 802.1X enabled globally.
- alice on PC1 is authorized by 802.1X into VLAN 10 and has a DHCP lease in 10.10.10.0/24.
- PRN1, which has no 802.1X supplicant, is authorized by MAB into VLAN 20 and has a lease in 10.20.20.0/24.
- VISITOR, unknown to ISE, ends up in guest VLAN 30 with a lease in 10.30.30.0/24.
The lab checks the result, not the exact commands. For example, a ping task passes only when the ping really succeeds through the network you built.