CloudLabBox
Try the free demo

Aruba CX lab 14 of 16

MAC authentication with role policies and device profiles

Bring printers and cameras onto a port-access network without opening it up: MAC authentication, a role policy that really drops traffic, client and device mode side by side, a device profile, 802.1X and MAC authentication on one port, and a critical role for a RADIUS outage.

Run this lab

It needs Lite: its 5 nodes are set to 6 vCPU and 7,168 MB in total. That fits the free demo too.

In your workspace: Shared, then HPE Aruba Networking CX switching guided labs, then 14 - MAC authentication with role policies and device profiles

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 75 minutes
Nodes need
6 vCPU, 7,168 MB
Smallest plan
Lite

The scenario

802.1X went on at Northwind last week, and the print room stopped working. Printers and cameras have no supplicant, so they can't answer the switch's questions. You'll bring them on without opening the door again: MAC authentication for the printer, a policy that limits what a printer may reach, a device profile for the cameras, and a plan for when the RADIUS server is down.

DeviceInterfaceAddress
acc1vlan 10 STAFF · 30 SERVERS · 40 PRINTERS · 50 CAMERAS · 99 QUARANTINE10.10.10.1 · 10.30.30.1 · 10.40.40.1 · 10.50.50.1 · 10.99.99.1 (all /24)
rad1eth0 (acc1 1/1/3, VLAN 30)10.30.30.10/24. RADIUS, and the print server on TCP 8080
PC1eth0 (acc1 1/1/1)DHCP. MAC 02:cb:00:00:14:01, has the lab1x client
PRN1eth0 (desk switch to acc1 1/1/2)DHCP. MAC 02:cb:00:00:14:02, no client
CAM1eth0 (desk switch to acc1 1/1/2)DHCP. MAC 02:cb:51:00:00:03, no client

acc1 already has what lab 13 built: RADIUS group NAC (key Rad-Key-2026), roles STAFF, CONTRACTOR and QUARANTINE, and 802.1X on 1/1/1 and 1/1/2. rad1's accounts are in /opt/lab/radius-users.txt: alice (Alice-Pass1, role STAFF), the printer's MAC (role PRINTER) and PC1's MAC (role QUARANTINE). The camera isn't listed. rad1 is this course's small teaching server, as in lab 13: it speaks real RADIUS and EAP-MD5, and doesn't replace a policy server such as ClearPass.

What you’ll practise

  • Enable MAC authentication and explain what it does and does not prove
  • Attach a port-access policy to a role, and explain the implicit deny
  • Compare client mode and device mode on a shared port
  • Build a device profile from a MAC group and a role
  • Run 802.1X and MAC authentication on one port and tune the fallback
  • Use a critical role and recognise it in the client table

The tasks

  1. The printer problem
  2. MAC authentication
  3. Two devices behind one port
  4. A device profile for the cameras
  5. A role with a policy
  6. Both methods on one port
  7. When RADIUS is down

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of MAC authentication with role policies and device profiles5 nodes and 1 network, 5 links. Every link is listed as text below the diagram.acc1rad1PC1PRN1CAM1DESKeth0eth01/1/21/1/3eth01/1/1eth0
5 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • acc1 1/1/1 to PC1 eth0
  • acc1 1/1/2 to DESK (network)
  • PRN1 eth0 to DESK (network)
  • CAM1 eth0 to DESK (network)
  • acc1 1/1/3 to rad1 eth0
Nodes in MAC authentication with role policies and device profiles, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
acc1Aruba AOS-CX virtual switcharubacx-10.142 vCPU, 3,072 MB
rad1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
PC1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
PRN1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
CAM1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder HPE Aruba Networking CX switching guided labs.

  3. Open 14 - MAC authentication with role policies and device profiles and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Aruba CX labs

All Aruba CX labs

Related labs in other courses

CloudLabBox is independent of Hewlett Packard Enterprise. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.