CloudLabBox
Try the free demo

Aruba CX lab 13 of 16

802.1X port access with RADIUS and local roles

Close Northwind's open wall ports: point AOS-CX at a RADIUS server, build local roles, turn on 802.1X and watch real EAP logins pick a role and a VLAN, with a reject role, re-authentication, accounting and RADIUS logins to the switch itself.

Run this lab

It needs Lite: its 4 nodes are set to 5 vCPU and 6,144 MB in total. That fits the free demo too.

In your workspace: Shared, then HPE Aruba Networking CX switching guided labs, then 13 - 802-1X port access with RADIUS and local roles

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 75 minutes
Nodes need
5 vCPU, 6,144 MB
Smallest plan
Lite

The scenario

Northwind's audit found a simple hole: any laptop plugged into a wall port lands on the staff VLAN, with nobody asking who it is. You're putting 802.1X on the access switch acc1. From now on the switch asks every device who it is, a RADIUS server decides, and the answer picks a role and a VLAN. Alice is staff, Bob is a contractor, and anyone else gets nothing.

DeviceInterfaceAddress
acc1vlan 10 STAFF · vlan 20 CONTRACTORS · vlan 30 SERVERS · vlan 99 QUARANTINE10.10.10.1 · 10.20.20.1 · 10.30.30.1 · 10.99.99.1 (all /24)
rad1eth0 (acc1 1/1/3, VLAN 30)10.30.30.10/24 via 10.30.30.1
PC1eth0 (acc1 1/1/1)DHCP from acc1
PC2eth0 (acc1 1/1/2)DHCP from acc1
Account on rad1PasswordWhat RADIUS sends back
alice (802.1X)Alice-Pass1role STAFF
bob (802.1X)Bob-Pass1role CONTRACTOR
netadmin (switch login)Netadmin-Pass1administrators
netview (switch login)Netview-Pass1operators

The RADIUS shared key is Rad-Key-2026.

About the lab tools. None of our images has a full RADIUS server or an 802.1X client, so this course brings two small programs of its own: labradius.py on rad1 and the lab1x client on the PCs. They speak real EAPOL, EAP and RADIUS, but only the EAP-MD5 method, which is fine for learning the switch's side and isn't used on real networks. Production uses PEAP or EAP-TLS with a policy server such as ClearPass, which we don't host. AOS-CX relays EAP without looking inside it, so what you configure here is what you'd configure there.

What you’ll practise

  • Define a RADIUS server and server group and turn on port-access accounting
  • Build local port-access roles that set a VLAN
  • Enable the 802.1X authenticator globally and per port, and read the client table and its flags
  • Explain the supplicant, authenticator and authentication server, and pass-through EAP
  • Use a reject role and explain the quiet period
  • Configure periodic re-authentication and read accounting records
  • Authenticate switch logins with RADIUS and tell administrators from operators

The tasks

  1. See the hole
  2. Point the switch at RADIUS
  3. Build the local roles
  4. Switch on 802.1X
  5. Log in
  6. What a refused login looks like
  7. Re-authentication and accounting
  8. Log in to the switch with RADIUS

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of 802-1X port access with RADIUS and local roles4 nodes, 3 links. Every link is listed as text below the diagram.acc1rad1PC1PC21/1/1eth01/1/2eth01/1/3eth0
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • acc1 1/1/1 to PC1 eth0
  • acc1 1/1/2 to PC2 eth0
  • acc1 1/1/3 to rad1 eth0
Nodes in 802.1X port access with RADIUS and local roles, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
acc1Aruba AOS-CX virtual switcharubacx-10.142 vCPU, 3,072 MB
rad1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
PC1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
PC2EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder HPE Aruba Networking CX switching guided labs.

  3. Open 13 - 802-1X port access with RADIUS and local roles and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Aruba CX labs

All Aruba CX labs

Related labs in other courses

CloudLabBox is independent of Hewlett Packard Enterprise. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.