Specify a tagged VLAN for when the authentication server is unavailable 7.4.4

Starting in FortiOS 7.4.4, you can specify a tagged VLAN for users to be assigned to when the authentication server is unavailable. Previously, you could only specify an untagged VLAN. This feature is available with 802.1x MAC-based authentication. It is compatible with both Extensible Authentication Protocol (EAP) and MAC authentication bypass (MAB).

Configuration example

In this configuration example, port7 of the FortiGate-201E is connected to port47 of a managed FortiSwitch unit.

1. Configure the FortiGate device to assign users to VLAN25 when the authentication servers is unavailable:

   config switch-controller security-policy 802-1X

   edit "SPMMFAC125"

   set security-mode 802.1X-mac-based

   set user-group "FACGRP125"

   set mac-auth-bypass enable

   set open-auth disable

   set eap-passthru enable

   set eap-auto-untagged-vlans enable

   set guest-vlan enable

   set guest-vlan-id "VLAN100"

   set auth-fail-vlan enable

   set auth-fail-vlan-id "VLAN200"

   set framevid-apply enable

   set radius-timeout-overwrite disable

   set authserver-timeout-vlan disable

   set authserver-timeout-tagged static

   set authserver-timeout-tagged-vlanid "VLAN25"

   next

   end

2. Use FortiOS to configure the static port (port7) on the managed switch:

   config switch-controller managed-switch

   edit S148EP5919000995

   config ports

   edit "port7"

   set poe-capable 1

   set vlan "_default"

   set allowed-vlans "VLAN25"

   set untagged-vlans "quarantine"

   set port-security-policy "SPMMFAC125"

   set export-to "root"

   set mac-addr e8:1c:ba:d3:f8:3b

   next

   end

   next

   end

3. Configure the lldp-voice security policy:

   config switch-controller security-policy 802-1X

   edit "SPMMCISEGRP"

   set security-mode 802.1X-mac-based

   set user-group "CISEGRP"

   set mac-auth-bypass enable

   set open-auth disable

   set eap-passthru enable

   set eap-auto-untagged-vlans disable

   set guest-vlan enable

   set guest-vlan-id "VLAN100"

   set auth-fail-vlan enable

   set auth-fail-vlan-id "VLAN200"

   set framevid-apply enable

   set radius-timeout-overwrite disable

   set authserver-timeout-vlan disable

   set authserver-timeout-tagged lldp-voice

   next

   end

   config switch-controller lldp-profile

   edit "VOICE25"

   set med-tlvs inventory-management network-policy location-identification

   config med-network-policy

   edit "voice"

   set status enable

   set vlan-intf "VLAN25"

   set assign-vlan enable

   next

   edit "voice-signaling"

   set status enable

   set vlan-intf "VLAN25"

   set assign-vlan enable

   next

   edit "guest-voice"

   next

   edit "guest-voice-signaling"

   next

   edit "softphone-voice"

   next

   edit "video-conferencing"

   next

   edit "streaming-video"

   next

   edit "video-signaling"

   next

   end

   config med-location-service

   edit "coordinates"

   next

   edit "address-civic"

   next

   edit "elin-number"

   next

   end

   next

   end

4. Apply the LLDP profile to the managed switch port that is configured for lldp-voice:

   config switch-controller managed-switch

   edit S148EP5919000995

   config ports

   edit "port3"

   set poe-capable 1

   set vlan "_default"

   set allowed-vlans "quarantine"

   set untagged-vlans "quarantine"

   set port-security-policy "SPMMCISEGRP"

   set lldp-profile "VOICE25"

   set export-to "root"

   set mac-addr e8:1c:ba:d3:f8:37

   next

   end

   next

   end