<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><DIV>use-tunneled-reply = yes is already set in peap section in eap.conf</DIV>
<DIV> </DIV>
<DIV>The config on our switch look like this: </DIV>
<DIV> </DIV>
<DIV> [uac_quid002]dis cur</DIV>
<DIV> </DIV>
<DIV> sysname uac_quid002<BR>#<BR> radius nas-ip 192.168.100.5<BR>#<BR> domain default enable uacdom<BR>#<BR> dhcp-server 1 ip 192.168.100.2<BR> dhcp-server 2 ip 192.168.5.1<BR>#<BR> dot1x<BR> dot1x authentication-method eap<BR>#<BR>radius scheme system<BR>radius scheme uac_aaa<BR> server-type standard<BR> primary authentication 172.21.0.10<BR> primary accounting 172.21.0.10<BR> key authentication xxxxx</DIV>
<DIV> key accounting xxxxxx<BR> user-name-format without-domain<BR> nas-ip 192.168.100.5<BR>#<BR>domain system</DIV>
<DIV> scheme radius-scheme uac_aaa<BR> authentication radius-scheme uac_aaa<BR>domain uacdom<BR> scheme radius-scheme uac_aaa<BR> authentication radius-scheme uac_aaa<BR>#<BR>local-user admin<BR> password simple xxxxxx<BR> service-type telnet<BR> level 3<BR>#<BR>vlan 1<BR>#<BR>vlan 2<BR> name students<BR>#<BR>vlan 3<BR> name STAFF<BR>#<BR>#<BR>interface Vlan-interface1<BR> ip address 192.168.100.5 255.255.255.0<BR>#<BR>interface Vlan-interface2<BR> ip address 192.168.5.5 255.255.255.0<BR>#<BR>interface Vlan-interface3<BR> ip address 10.3.0.2 255.255.0.0<BR>#<BR>interface Vlan-interface4<BR> ip address 10.4.0.2 255.255.0.0<BR>#</DIV>
<DIV>#<BR>interface Ethernet1/0/1<BR> port link-type hybrid<BR> port hybrid vlan 1 to 4 tagged<BR> dot1x port-method portbased<BR> dot1x guest-vlan 1<BR> dot1x<BR>#<BR>interface Ethernet1/0/2<BR> dot1x port-method portbased<BR>#<BR>interface Ethernet1/0/3<BR> dot1x port-method portbased<BR> dot1x guest-vlan 1<BR>#<BR>interface Ethernet1/0/4<BR> port link-type hybrid<BR> port hybrid vlan 1 to 4 tagged<BR> dot1x port-method portbased<BR> dot1x guest-vlan 1<BR> dot1x<BR>#<BR>interface Ethernet1/0/5</DIV>
<DIV> port link-type hybrid<BR> port hybrid vlan 1 to 4 tagged<BR> dot1x port-method portbased<BR> dot1x guest-vlan 1<BR> dot1x<BR>#<BR>interface Ethernet1/0/10<BR> port link-type trunk<BR> port trunk permit vlan 1 to 4<BR> dot1x port-method portbased<BR> dot1x guest-vlan 1<BR>#</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">the detailed domain setting is as follow: </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">[uac_quid002]dis domain uacdom<BR>The contents of Domain uacdom:<BR> State = Active<BR> RADIUS Scheme = uac_aaa<BR> Authentication : RADIUS Scheme = uac_aaa<BR> Access-limit = Disable<BR> Vlan-assignment-mode = Integer<BR> Domain User Template:<BR> Idle-cut = Disable<BR> Self-service = Disable<BR> Messenger Time = Disable</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">so Vlan-assignment-mode is Integer.</DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Where are the tricks?<BR></DIV>
<DIV style="FONT-SIZE: 13px; FONT-FAMILY: arial, helvetica, sans-serif"><FONT face=Tahoma size=2>
<HR SIZE=1>
<B><SPAN style="FONT-WEIGHT: bold">De :</SPAN></B> Guk Victor <v.guk@zaz.zp.ua><BR><B><SPAN style="FONT-WEIGHT: bold">À :</SPAN></B> freeradius-users@lists.freeradius.org<BR><B><SPAN style="FONT-WEIGHT: bold">Envoyé le :</SPAN></B> Mardi, 23 Juin 2009, 15h23mn 40s<BR><B><SPAN style="FONT-WEIGHT: bold">Objet :</SPAN></B> Re: Re : Re : Re : Re : Radius+Huwaei switch + auto VLan, Assignment issue<BR></FONT><BR>You will place use-tunneled-reply=yes in peap config.<BR><BR>This is right config 3Com 4500(V3.03.00):<BR>#<BR>domain default enable company<BR>#<BR>dot1x<BR>dot1x authentication-method eap<BR>undo dot1x handshake enable<BR>#<BR>radius scheme Radius<BR>server-type extended<BR>primary authentication x.x.x.x<BR>primary accounting x.x.x.x<BR>key authentication qwerty<BR>key accounting qwerty<BR>user-name-format without-domain<BR>#<BR>domain company<BR>scheme radius-scheme Radius<BR>vlan-assignment-mode string<BR>accounting
optional<BR>#<BR>#<BR>interface Ethernet1/0/1<BR>stp edged-port enable<BR>broadcast-suppression pps 3000<BR>packet-filter inbound link-group 4999 rule 0<BR>dot1x port-method portbased<BR>dot1x<BR>#<BR><BR>File "users":<BR>username Tunnel-Type = VLAN<BR> Tunnel-Medium-Type = IEEE-802<BR> Tunnel-Private-Group-ID = "2"<BR><BR>-<BR>List info/subscribe/unsubscribe? See <A href="http://www.freeradius.org/list/users.html" target=_blank>http://www.freeradius.org/list/users.html</A><BR></DIV></div><br>
</body></html>