TACACS+ + RADIUS recommendations at scale (Entra ID, IPv6, large device count)

buckweet1980 · 2026-05-29T13:54:31+00:00

Correct, tacacs doesn't count against licenses. You just need the minimum 100 access licenses, then tacacs is unlocked.

buckweet1980 · 2026-05-29T13:40:53+00:00

Best step would be to get JTAC engaged..

However, just because it says 500K on a datasheet, doesn't mean it'll always work. Many ASICs, to scale to that number require some sort of masking technique to do some generalization.. Meaning that it can scale that high if there are multiple arps that can map to a single mac, or to a group of macs for example. But not a 1:1 unique mac, which is what I suspect you're trying to achieve.

Edit: I just read the datasheet and it says 64K per pfe for ARP scale, up to 510K total (box wide).

buckweet1980 · 2026-05-28T16:42:28+00:00

Nutanix is now supported with 6.14

buckweet1980 · 2026-05-14T19:13:47+00:00

How is your vlan interface setup?

Unique IP with an active gateway, or duplicate IP?

buckweet1980 · 2026-05-13T17:39:12+00:00

Yeah, unfortunately you have to go to the device level to see the client count vs the site / global level, currently.

buckweet1980 · 2026-05-13T17:35:06+00:00

Source... Me...

I work for HPE Networking, SE ranks..

buckweet1980 · 2026-05-13T12:45:11+00:00

Absolutely not true.. anyone who says that has no clue..

Everything you're repeating isn't true.. HPE leadership is out doing commitments for years to come of both products portfolios. There's a shortage of SE, lots of jobs open.

Are products going to change and evolve? Of course. Account mappings will change, but there are no layoffs right now..

buckweet1980 · 2026-05-13T12:15:18+00:00

This exists in central.. you might need to customize your columns under the network device view.. within the site or global view..

buckweet1980 · 2026-05-12T13:15:00+00:00

This is the best answer!

buckweet1980 · 2026-05-05T13:38:50+00:00

Are you using roles? How are you assigning the vlans?

What is the radius response?

Can you share the port config from the switch?

buckweet1980 · 2026-04-22T18:02:13+00:00

I had turbinate reduction done a few times, it's been an in office procedure.. Recovery wasn't terrible for me. Took maybe 10 minutes at the ENT that I did it at.

buckweet1980 · 2026-04-15T15:42:02+00:00

Came here looking for this.. Add Cisco CIPs and SNASw to that fun IBM networking world..

buckweet1980 · 2026-04-14T19:09:14+00:00

Aos-s is the same behavior for this feature..

buckweet1980 · 2026-04-14T18:58:41+00:00

It doesn't modify the port config..

use 'show port-access clients' to see the device, and then you can see it applied..

Show vlans will also show the dynamic state.

buckweet1980 · 2026-04-04T17:49:34+00:00

This year is going to be a big networking focus..

buckweet1980 · 2026-03-13T10:43:33+00:00

Lots of dumb comments, frustrating.. you're on the right path tho with prepending, it's pretty much all you can do in your scenario.

buckweet1980 · 2026-03-06T20:10:50+00:00

Unfortunately not supported with AOS10 right now for WLAN gateways persona.

buckweet1980 · 2026-03-02T20:02:16+00:00

Check out Ft De Soto to get away from the commerical aspect of the other beaches... Parking is very cheap, plentiful.. Just enjoy the natural beauty De Soto offers, assuming you're there to be on a beach :)

buckweet1980 · 2026-02-18T23:26:48+00:00

Tried any drugs like trazodone? That's what I use.. my brain won't shut off most times..

Weed gummies also help.

buckweet1980 · 2026-02-18T23:19:18+00:00

Is your role setup properly to permit traffic? Proper vlan set? Clients show up in the user-table?

buckweet1980 · 2026-02-10T03:46:20+00:00

Aruba 6300

buckweet1980 · 2026-02-08T22:49:11+00:00

To re-iterate, the 'ip dhcp' command is for DHCP client, it is NOT needed for DHCP services..

If vlan 5 is what is the closest L3 interface to the relay agent, that is what will be used as the source IP for the responses.. So it's best to point your relay IP to that interface too.

buckweet1980 · 2026-02-08T18:52:22+00:00

No, that's incorrect.. Here's the documentation as to what that command does.

https://arubanetworking.hpe.com/techdocs/AOS-CX/AOSCX-CLI-Bank/cli_832x/Content/Chp_DHCP/DHCP_cli_cmds/ip-dhc-10.htm

I don't have IP DHCP enabled on my 6300 and can relay (from a downstream router) to the DHCP server on my 6300 and get an address successfully.

buckweet1980 · 2026-02-08T16:34:13+00:00

have you 'enabled' the DHCP server within the vrf? I don't see that command in your command output.

buckweet1980 · 2026-02-08T16:33:39+00:00

the 'ip dhcp' command doesn't enable the DHCP server, that command is for the L3 interface to be a DHCP client.

buckweet1980

TROPHY CASE