<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman,new york,times,serif;font-size:12pt"><div style="margin-left: 40px;"><br></div><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><br><div style="font-family: arial,helvetica,sans-serif; font-size: 13px;"><font face="Tahoma" size="2"><hr size="1"><b><span style="font-weight: bold;">From:</span></b> Alan Buxey <A.L.M.Buxey@lboro.ac.uk><br><b><span style="font-weight: bold;">To:</span></b> FreeRadius users mailing list <freeradius-users@lists.freeradius.org><br><b><span style="font-weight: bold;">Sent:</span></b> Sun, January 31, 2010 12:16:17 PM<br><b><span style="font-weight: bold;">Subject:</span></b> Re: Allowing Access via 'users' when LDAP fails<br></font><br>
Hi,<br><br>what switches? with Cisco you can use various fallthroughs - and you can<br>ensure that even the non 802.1X clients are catered for.... MAB will allow<br>you to send request to RADIUS server and then its your policy that matters..<br>eg<br><br>eg any MAC address, returns an ACCEPT but with a VLAN attribute. the switch then<br>puts the client on the correct, limited network.... or you can use guest-vlan<br>or fail vlan methods on the switch too... <br><br>..are you going via the route of 'if not known, then get a network that send them<br>to a web portal with intructions, install program etc' - or are you dealing<br>with these people individually?<br><br>alan<br>-<br><span>List info/subscribe/unsubscribe? See <a target="_blank"
href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a></span><br><br>---------------------------------------------------------------------------------------------------------------------------------<br><br>Alan,<br><br>I'm using Cisco 3560G switches. If a client currently doesnt send EAPOL packets<br>to the switch, the 'guest vlan' works perfectly. <br><br>However, my clients ARE dot1x capable, and DO send EAPOL packets to the switch<br>and that makes the switchport stay unavailable for too long while the switch attempts<br>to reauthenticate the client (takes about 65 seconds), by which time the end users<br>client didnt get an IP address and they cannot login to the AD.<br><br>I just want a port to come up immediately on a guest/restricted type VLAN, allow the<br>client to receive an IP address via DHCP, allow them to authenticate against the AD,<br>and then be placed into the correct vlan (and
have DHCP get a new IP address natrually)<br><br>The cisco guest-vlan or restricted-vlan or fallback vlan or whatever it is, works.. it just<br>takes too dang long! My end users arent going to just sit at their desktops for two or three<br>minutes staring at the logon window before attempting a login.<br><br>Can you share with me a sample configuration of how I can accomplish this in IOS?<br>I swear I've been toying with various configuration settings for days now.<br><br>Thanks!<br><br>AMARU<br></div></div>
<!-- cg5.c2.mail.ac4.yahoo.com compressed/chunked Mon Feb 1 07:32:53 PST 2010 -->
</div><br>
</body></html>