<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman,new york,times,serif;font-size:12pt"><div><br></div><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><br><div style="font-family: arial,helvetica,sans-serif; font-size: 13px;"><font face="Tahoma" size="2"><hr size="1"><b><span style="font-weight: bold;">From:</span></b> Alan Buxey <A.L.M.Buxey@lboro.ac.uk><br><b><span style="font-weight: bold;">To:</span></b> FreeRadius users mailing list <freeradius-users@lists.freeradius.org><br><b><span style="font-weight: bold;">Sent:</span></b> Mon, February 1, 2010 9:51:42 AM<br><b><span style="font-weight: bold;">Subject:</span></b> Re: Allowing Access via 'users' when LDAP fails<br></font><br>
Hi,<br><br>> I'm using Cisco 3560G switches. If a client currently doesnt send EAPOL packets<br>> to the switch, the 'guest vlan' works perfectly.<br>> <br>> However, my clients ARE dot1x capable, and DO send EAPOL packets to the switch<br>> and that makes the switchport stay unavailable for too long while the switch attempts<br>> to reauthenticate the client (takes about 65 seconds), by which time the end users<br>> client didnt get an IP address and they cannot login to the AD.<br><br>adjust the switch timers then - the default timers will cause the effect<br>you have outlines...too long to fail-through<br><br>> I just want a port to come up immediately on a guest/restricted type VLAN, allow the<br>> client to receive an IP address via DHCP, allow them to authenticate against the AD,<br>> and then be placed into the correct vlan (and have DHCP get a new IP address natrually)<br><br>how will then authenticate against
the AD after they are on this restricted<br>network? captive portal box? the supplicant wont do anything after the first stage<br><br>you might want to read this guide"<br><br><span><a target="_blank" href="http://www.cisco.com/univercd/cc/td/doc/solution/macauthb.pdf">http://www.cisco.com/univercd/cc/td/doc/solution/macauthb.pdf</a></span><br><br>this gives more info on timers/timeouts for each part.... simply reduce<br>a few timers like max-req and tx-period and you'll get guest-vlan fall-through<br>within a few seconds<br><br>alan<br>-<br><span>List info/subscribe/unsubscribe? See <a target="_blank" href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a></span><br><br><br>Alan,<br><br>Thanks for your quick reply! The plan was to have the guest/restricted VLAN have<br>permissions enough to allow the client to authenticate against my AD, and then be <br>assigned to the appropriate vlan, where
full 'network rights' would be granted.<br><br>I will check out that document right now.. sounds perfect. Thanks!<br>+AMARU<br><br><br></div></div>
<!-- cg5.c2.mail.ac4.yahoo.com compressed/chunked Mon Feb 1 07:32:53 PST 2010 -->
</div><br>
</body></html>