<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>Not rejecting rejected users</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Hi all,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Possibly a ridiculous question, but I’ll try anyway.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">We have freeradius running for wired and wireless clients. On wired clients, when the radius sends a reject</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> packet to the NAS, all is well and the client gets rejected. On wireless however, especially with windows XP machines, the machine will constantly retry connection to the SSID.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">We’ve dealt with this in the past by hiding the SSID and hoping non-authenticated people try not to join it. This breaks the recommendations I believe, and causes certain issues with ipads and so on, so I wanted to do something different</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">–</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> i.</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">e. dish out a dummy vlan or special role to the wireless controller. No problems there in concept, but we were very geared towards accepts and rejects and I now need to, at several points, do something else instead of outright reject the client.</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Rejects were nice because once auth-type is set to reject, anything else that could alter the auth-type</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> would not be touched, and lots of extraneous processing is avoided. Ideally we’d be able to change the post-auth-type REJECT back into an accept, but that probably isn’t going to work.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Anyone any ideas? I</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">’m sure this has been done before.</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">I realise we can override the outcome of a specific module but it doesn’t stop processing unless I keep checking an internal control variable or the like.</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Thanks</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Andy</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
</BODY>
</HTML>