<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style>
<!--
@font-face
{font-family:Calibri}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif"}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
span.EmailStyle17
{font-family:"Calibri","sans-serif";
color:windowtext}
.MsoChpDefault
{font-size:10.0pt;
font-family:"Calibri","sans-serif"}
@page WordSection1
{margin:72.0pt 72.0pt 72.0pt 72.0pt}
div.WordSection1
{}
-->
</style>
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I’m in the process of attempting to move our 802.1x services off of an aging freeRADIUS (v1) server onto a newly built server running freeRADIUS v2.2</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Tests so far with wireless clients using 802.1x PEAP/MS-CHAPv2 are working ok. Clients can authenticate (against AD) and be assigned the different vlans that I want them to be assigned. So the authentication, AD interaction & vlan assignment
are all working as should be there.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">However, we also use wired 802.1x on some of our HP 5406 switches. This currently works fine with the existing old freeRADIUS server, so the actual switch configs (I’ve tested more than one) must be ok. But I cannot get the switches to
use the assigned vlan that the clients (who again use PEAP/MS-CHAPv2) are given with the new freeRADIUS server. I’ve not changed the vlans that are to be used, the only change is the switch now points to the new RADIUS server.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Running radiusd –X shows that the correct attributes are still being supplied early on in the authenticate process:</p>
<p class="MsoNormal">“Sending Access-Challenge of id 123 to x.x.x.x port 1812</p>
<p class="MsoNormal"> Tunnel-Type:0 = VLAN</p>
<p class="MsoNormal"> Tunnel-Medium-Type:0 = IEEE-802</p>
<p class="MsoNormal"> Tunnel-Private-Group-Id:0 = "resnet"</p>
<p class="MsoNormal"> EAP-Message = 0x010200061920</p>
<p class="MsoNormal"> Message-Authenticator = 0x00000000000000000000000000000000</p>
<p class="MsoNormal"> State = 0xe74e7176e74c686cb9198540381901eb”</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Note I’ve also tried the vlan id number as well as the name (although the name works fine in the old server, so should be fine here). Plus I’ve tried using Egress-VLANID or Egress-VLAN-Name, but it made no difference. Lastly, for testing
purposes, if I insert the required attributes into the default post-auth then it all works and the wired client is assigned the correct vlan, so again the switch side must be ok and I also therefore presume all the dictionary entries are there as required.
But I shouldn’t need (or want) to do this.</p>
<p class="MsoNormal">i.e. in post-auth</p>
<p class="MsoNormal"> update reply {</p>
<p class="MsoNormal"> Tunnel-Type := "VLAN"</p>
<p class="MsoNormal"> Tunnel-Medium-Type := "IEEE-802"</p>
<p class="MsoNormal"> Tunnel-Private-Group-ID := "resnet"</p>
<p class="MsoNormal"> }</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">It’s as though the attributes are being removed or ignored somewhere in the PEAP/inner-tunnel process (but that’s just a guess).</p>
<p class="MsoNormal">What am I just not getting here? I’m sure it must be something simple but I can’t see it.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Hopefully this sort of thing has been done enough times that someone out there has fallen into whatever trap I currently find myself in and can point me in the right direction I need to be looking. But if not, I can of course supply the
output of radiusd –X and the switch debug if it’s going to help any.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Thanks in advance,</p>
<p class="MsoNormal">Colin</p>
<p class="MsoNormal"> </p>
</div>
<br>
<br>
<br>
<br>
<font face="Arial" color="maroon">The University of Aberdeen is a charity registered in Scotland, No SC013683.<font></font></font>
</body>
</html>