<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style></head>
<body>
<body>Nick, the joy of frees is that you can do this is umpteen different ways.<br><br>I would recommend that you use unsung unlang to check the ssid in the request and then proxy that request to a different virtual server to deal with in the way you want<br><br>Alan<br>--<br>Message may be brief as it has been sent from my mobile<br><br>----- Reply message -----<br>From: "James J J Hooper" <jjj.hooper@bristol.ac.uk><br>Date: Tue, Jul 12, 2011 08:19<br>Subject: Yet another multiple SSID setup question<br>To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org><br><br></body>
<font size="2"><div class="PlainText">On 12/07/2011 02:50, Nick Kartsioukas wrote:<br>
> I've been looking through the wiki and staring at the config files and<br>
> I'm...confused.<br>
> I've successfully gotten our Cisco WLC to authenticate against<br>
> ActiveDirectory as well as a Sun LDAP server (just one at a time) via<br>
> FreeRADIUS for a single test SSID, but now I'm trying to figure out how<br>
> to split that into conditional checks. Before I go chopping up the<br>
> existing config files and making a horrible mess of things, I wanted to<br>
> verify a few things with the wisdom of the list.<br>
><br>
> Okay...let's say I have an SSID for students and an SSID for staff.<br>
> Students authenticate against LDAP, which stores passwords as salted<br>
> SHA1 hashes. Staff authenticate against Windows ActiveDirectory.<br>
> I've found where the WLC sends the SSID to FreeRADIUS, so I can get at<br>
> that. My question is, how do I set up the EAP-TTLS/PAP session for the<br>
> Student SSID and the separate PEAP/MSCHAPv2 session for the Staff SSID?<br>
> Are these configured as different virtual servers? Or just different<br>
> modules that I call from the users file like so:<br>
> DEFAULT Auth-Type := student_module, Called-Station-SSID := "student"<br>
> DEFAULT Auth-Type := staff_module, Called-Station-SSID := "staff"<br>
><br>
> If so how do I set that up, as that would be two different eap.conf<br>
> setups (wouldn't it)? Am I missing something obvious in the docs?<br>
> Thanks for taking the time to help me out!<br>
<br>
If they are different SSIDs on the Cisco WLC, you should be able to assign <br>
different radius servers for each SSID. Do that, e.g:<br>
ssid1 -> 192.0.2.1:1645<br>
ssid2 -> 192.0.2.1:1812<br>
<br>
Then use a different FreeRADIUS virtual server to handle each (i.e. on <br>
virtual server listening on port 1812 , and one listening on port 1812).<br>
<br>
This way you can keep the intricacies of each separate.<br>
<br>
-James<br>
-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><br>
</div></font>
</body>
</html>