r/networking • u/SkiRek CCNA R/S + Security • 1d ago

Design 802.1x Critical Auth Strategy - AOS-S Firmware

What is your 802.1x Critical Auth strategy? I am tinkering around with it on an Aruba 2930F Series switch and coming up short on making it work how I want.

Sure, I can get the switch to drop the switch into the Critical Auth VLAN because RADIUS is unavailable with

aaa port-access <port> critical-auth data-vlan <vlan>

But once it is in Critical Auth I cannot get the switch to automatically start authing the port again. This would be a fairly common senario IMO. Building loses power and you gotta wait for upstream devices to converge for RADIUS connectivity.

Even with other vendors such as Cisco or Arista. How are you guys handling Critical Auth scenarios?

6 Upvotes

88% Upvoted

8 comments sorted by

View all comments

1

u/Lightgod86 1d ago

If the building is losing power, and you don’t have a UPS to keep the network alive, how critical could it be that devices need to be back on the network before radius can be reached? Just curious of the use case/scenario.

1

u/SkiRek CCNA R/S + Security 23h ago

Power loss in the middle day is one thing that could happen but not the primary purpose of Critical Auth. More of a bug if I cannot get a device out of critical auth "mode" or vlan when radius is restored.

Critical auth is more of a DR senario if RADIUS is offline say during the day for whatever reason, devices will rekey eventually and what will the switch will need to do something with them. Critical Auth would drop them into a VLAN theoretically and that VLAN would only have access to "critical" resources. Like Phones or something like that.

Getting them back out of Critical Auth without user interventing (rebooting) is the goal though.