<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000066">
<font face="serif"> </font>Alan DeKok wrote:
<blockquote cite="mid:47282A58.3040003@deployingradius.com" type="cite">
<pre wrap="">Doc. Caliban wrote:
</pre>
<blockquote type="cite">
<pre wrap="">All of our public workstations are on this interface so the machines are
verified at the proxy.
</pre>
</blockquote>
<pre wrap=""><!---->
So... how does it do that?</pre>
</blockquote>
<font face="serif">IPCop, the network router, is the NAS in this case.<br>
<br>
It has 3 interfaces, the WAN, LAN, and WiFi Access. (Known in IPCop as
Red, Green, and Blue.) A fourth interface (Orange) can be added as a
DMZ, but I don't need that at this time.<br>
<br>
The Blue interface requires a MAC address for each node allowed to
connect. Typically you'd just put the AP's MAC in there and let the AP
act as the DHCP server. In reality you can add the MAC for any device
you want, which is how the public machines are verified: The only way
they can connect in the first place is that I've added their MAC
addresses to the access list.<br>
<br>
IPCop can also require user authentication across both the Green and
Blue interfaces (It's all or nothing in that regard) via a local ACL,
identd, LDAP, Windows authentication, or RADIUS. My user database
already exists </font><font face="serif">in MySQL</font><font
face="serif">
for other reasons, so using RADIUS to tap into that is the easiest
solution. For various reasons, I also do not want to add about 80% of
the users to the
windows AD. <br>
<br>
The plus side of this is that anyone
using a public machine will have to be a valid user. The downside is
that the few people who are on the LAN (Green) interface will also have
to deal with RADIUS even though they are already validated in the
Windows domain. It had been suggested to add their MAC's to the user
database in MySQL and arrange it so that they are allowed to skip the
RADIUS process, but dealing with that is well out of my skill set. <br>
<br>
In January we will receive a bunch of Cisco AP's to replace the rather
motley collection that we are using now. At that point I will look at
handing the NAS functions to them, but for now it will happen
at the router.<br>
<br>
>From the feedback, it sounds like I'm heading in the right direction
with PEAP / MS-CHAP-V2, which is what my test laptop came up with
automatically. I will also be sure to incorporate the suggestions
regarding the proper configuration of the clients in implementing this.<br>
<br>
This has been a great resource! Thanks to everyone who has responded,
and to whoever set up and maintains the mailing list.<br>
<br>
Regards,<br>
<br>
-Doc</font>
</body>
</html>