HP-Aruba Wired Layer 2 Integration (ArubaOS)

Note – In this example, an Aruba S2500 configuration is provided as tested on ArubaOS 7.4.1.7, however any ArubaOS Layer 2 switch supporting the following features are eligible for integration. This integration is not intended for HPE switches running non-ArubaOS software (K or Y software versions).

Note – If your ArubaOS switch is running in Tunneled Node mode, all traffic from the switch ports is tunneled directly to the controller. NAC would integrate directly with the controller in that scenario instead of the switch.

Note – In this example the NAC RADIUS Server / Policy Server is 10.10.10.10 (replace this IP with the IP of your NAC system)

Note – Be sure to remove comments in (BOLD) before cutting and pasting script into the switch

Bash

Copy

›

›

conf t

!

netservice svc-sc_https tcp 8443

netservice svc-sc_https2 tcp 9443

netservice svc-sc_http tcp 8008

!

netdestination apple-cna…

!

ip access-list session sc_compliant_acl

any any any permit

!

ip access-list session sc_guest_acl

any network x.x.x.x x.x.x.x any deny (any network denied to guest users - optional)

!

ip access-list session sc_intranet_acl

any host x.x.x.x any permit (any internal resource allowed to quarantined users - optional)

!

ip access-list session sc_redirect_acl

any host 198.31.193.211 any redirect tunnel 1

!

ip access-list session sc_quarantine_acl

This completes the ArubaOS switch configuration for NAC integration.

Note – The switch must now be added to the NAC RADIUS server. Refer to the NAC RADIUS Server Configuration guide for details on how to add the switch as a NAS.

Note – Unless 802.1X is required, be sure to select the MAC Authentication Only mode when configuring the NAC RADIUS server.