3.1.10.2.26. setVlanSync

The setVlanSync plugin uses the OpenNAC tag engine to give users different access depending on which port of the network device they are connected to. It will read tags from the network device (SVP_PORT_<PORT-NUMBER>_<VLAN-NUMBER> or SVP_GENERAL_<VLAN-NUMBER>) and depending on which port they are connected to, the device will be given access to a VLAN or another.

../../../../_images/setvlansync.png


  • Execution order: Determines the order in which sync plugins are executed, with higher priority assigned to lower numerical values (0 being the lowest priority). In situations where multiple plugins share the same execution order value, the execution order will follow an alphabetical arrangement.

The VLAN configured in postconditions in ON NAC -> Policies (if it is configured) will only have effect if the network device tags doesn’t affect the connection of the user device.

The two types of tags that can be configured on the network device are the following:

  • SVP_PORT_<PORT-NUMBER>_<VLAN-NUMBER>: In this case the VLAN <VLAN-NUMBER> will be assigned to the user device if that device is connected to the {PORT-NUMBER} of this network device.

  • SVP_GENERAL_<VLAN-NUMBER>: In this case the VLAN <VLAN-NUMBER> will be assigned to the user device if the port where the user device is connected on the network device does not have a specific SVP_PORT tag.

Note

If the SVP_GENERAL tag does not exist in the network device and the port has not a specific SVP_PORT tag, the VLAN number configured in the policy will be assigned to the user device.

When a user device matches the policy, the plugin will generate the following status messages in ON NAC -> Business profiles depending on the VLAN assigned:

  • SET VLAN PLUGIN: Port switch VLAN [<VLAN-NUMBER>]: In this case, there is a SVP_PORT tag configured for the connection port on the network device. So the VLAN assigned is the corresponding to the tag SVP_PORT_<PORT-NUMBER>_<VLAN-NUMBER>.

  • SET VLAN PLUGIN: General switch VLAN VLAN [<VLAN-NUMBER>]: In this case, there is not a SVP_PORT tag configured for the connection port on the network device, but there is a SVP_GENERAL tag on the network device. So the VLAN assigned is the corresponding to the tag SVP_GENERAL_<VLAN-NUMBER>.

  • SET VLAN PLUGIN: Policy VLAN [<VLAN-NUMBER>]: In this case, there is not a SVP_GENERAL tag on the network device, and there is not a SVP_PORT tag configured for the connection port on the network device, so the policy VLAN configured on the postconditions is assigned to the user device.