topic Re: Dynamic Vlan Assignment via RADIUS (Microsoft NPS) - DHCP Failure in ZoneDirector

Dynamic Vlan Assignment via RADIUS (Microsoft NPS) - DHCP Failure

rob_coote — Fri, 11 Oct 2013 21:59:33 GMT

I'm in the process of consolidating a large number of SSID's into a single SSID using dynamic VLANS. I have followed the Ruckus documentation for configuring the appropriate attributes on the RADIUS server, and have an SSID set up for dynamic vlans on the Zonedirector.

My test clients connect to the SSID, and are prompted for credentials. I can see the credentials accepted on the NPS server, and wireshark confirms the Access-Accept message contains the Tunnel-Private-Group-ID value for the desired VLAN.

At this point the client stalls trying to get a DHCP lease. The DHCP server is working, as these are existing scopes and subnets and I can connect a wired client into the switch on an access port for the same vlan and get a lease.

Wireshark shows no DHCP broadcast request from the client at all.

The switchport for the AP is a trunk, with the VLAN tagged and allowed.

Any assistance would be greatly appreciated!
Rob

Re: Dynamic Vlan Assignment via RADIUS (Microsoft NPS) - DHCP Failure

sid_sok — Fri, 11 Oct 2013 23:05:22 GMT

Hi Rob,

I would suggest creating a test wlan in the clear so you can read the wireless capture and put it on a static VLAN to match the DVLAN is supposed to be assigned to, and see if you can get an IP that way and see if the client sends a DHCP discover.

You might want to mirror the AP's port and see if the AP got the Discover packet and if it's sending it out with the proper tag.

Re: Dynamic Vlan Assignment via RADIUS (Microsoft NPS) - DHCP Failure

primoz_marinsek — Mon, 14 Oct 2013 06:23:52 GMT

DVLANs work no problem. You are probably having networking issues. You must not tagg all VLANs on a port. Suggest you use management VLAN untagged and others tagged.

Re: Dynamic Vlan Assignment via RADIUS (Microsoft NPS) - DHCP Failure

rob_coote — Tue, 15 Oct 2013 17:21:41 GMT

Write a comment...

Re: Dynamic Vlan Assignment via RADIUS (Microsoft NPS) - DHCP Failure

rob_coote — Tue, 15 Oct 2013 17:27:29 GMT

Sid,

I did as you suggested and created a test WLAN with a static VLAN matching the DVLAN I am testing. The client associated and the DHCP request is seen in the packet capture, and the client receives an IP address assignment for the correct VLAN.

Rob

Re: Dynamic Vlan Assignment via RADIUS (Microsoft NPS) - DHCP Failure

rob_coote — Tue, 15 Oct 2013 19:53:47 GMT

http://forums-archive.ruckuswireless....

It might be a good idea to provide this information in the documentation for ZoneDirector and DVLAN configuration.

Re: Dynamic Vlan Assignment via RADIUS (Microsoft NPS) - DHCP Failure

keith_redfield — Tue, 15 Oct 2013 19:58:45 GMT

Is what you needed in here as well? https://support.ruckuswireless.com/an...

What was the "missing piece"?

Re: Dynamic Vlan Assignment via RADIUS (Microsoft NPS) - DHCP Failure

rob_coote — Tue, 15 Oct 2013 20:03:55 GMT

The vendor-specific attribute piece in NPS was required. It appears that NPS does not return AD groups to the ZoneDirector, so everything got dumped into the "Default" role. Adding the VSA (25053) with the AD group to match the ZD role appears to have resolved the issue in my test lab so far.