Lightspeed vs Cisco

[HermyBaby]

Long time lurker, first time poster.

 

We have a Lightspeed Rocket (Web Filter) v2.10.5 and are experiencing something that we have probably lived with for quite some time, until all of our students have received devices that is...

 

Our internal port on the Rocket plugs into a port on our Cisco core switch that has this configuration:

 

interface GigabitEthernet4/16

no ip address

speed 1000

duplex full

switchport

switchport access vlan 20

spanning-tree portfast

end

 

The external port on the Rocket plugs into our firewall.

 

Here is our issue. Every device that is NOT on the 20 VLAN is given the exact same MAC address (some base MAC given from spanning tree I think). According to Lightspeed, unique MAC addresses are important to getting properly identified by the content filter. This wasn't entirely noticeable until we put all of these student devices on our network. The only complaint we are getting is from the students when they cannot access YouTube (which means the filtering is randomly working). Any ideas/suggestions as to what I could possibly do port configuration-wise to make this work (if anything)? I've explained my plight to Lightspeed and at first they were super responsive, now they are in their ignore me mode -- I personally think they are stumped.

 

Thanks in advance.

Edited September 12, 2016 by HermyBaby

[MicrodigitUK]

What is doing your routing between VLANs? It sounds like you are using NAT and that will make all devices from other VLANs show as a MAC address of an interface on the device doing the routing. Change from NAT to standard routing between VLANs should resolve the issue.

[Opendium_Steve]

Here is our issue. Every device that is NOT on the 20 VLAN is given the exact same MAC address (some base MAC given from spanning tree I think).

 

The MAC address of the original sender (workstation) is only visible if the receiver (lightspeed) has layer 2 (ethernet) connectivity with that sender (i.e. they would both need to be on the same VLAN). As soon as the packet gets routed (layer 3 - IP), the original MAC will be replaced with the router's MAC. It would be unusual for the filtering server to have layer 2 connectivity with all of the VLANs on a reasonably sized network, so I don't think Lightspeed would usually require this?

 

I'm not terribly familiar with lightspeed, but based on how our own filtering system works, the exception I can think of is if you're using RADIUS accounting *and* your wifi controller can't provide the "Framed-IP-Address" attribute (Ruckus and Meru can provide that attribute, Ubiquity UniFi and Meraki can't). In that case, the only way to link network traffic with a particular RADIUS session is by MAC address, which means you'd need the filter and the user's device on the same VLAN.

Edited September 15, 2016 by Opendium_Steve