- Freeradius-Users - lists.freeradius.org

Using freeradius just for device administrative access
by Coy Hile 10 Dec '19

10 Dec '19

Hi all, I'm finally getting around to setting up RADIUS in my lab so I can centralize authentication and authorization access to network devices. Assume for sanity's sake, NAS information and user information stored in a SQL database. Does anyone have any boilerplate for what can be thrown away wholesale from the default configs when *not* doing 802.1x or other end-user authentication/authorization. -- Coy Hile coy.hile(a)coyhile.com

2 1

Allow same user to authenticate with different passwords
by Taymour Gabr 10 Dec '19

10 Dec '19

Hi All, We are trying to allow users to authenticate with different passwords using an SQL database and freeradius version 3.0.17 (hotel scenario, where unrelated people can have the same family name). I've already seen these two links: http://freeradius.1045715.n5.nabble.com/Help-FreeRadius-Users-with-multiple… http://lists.freeradius.org/pipermail/freeradius-users/2009-February/035570… and I've had a look at the queries.conf file for mysql. I found the 'authorize_check_query', but that query just resolves to present all the fields for the username, and 'authorize_check_query' is not used elsewhere to use those results to retrieve the password... . So I am still at a loss of how I can change freeradius to accept a different type of radcheck table with multiple fields for the password per user, and where I would change the logic of how it accepts any of these passwords. Addiionally it should use Simultaneous-Use checks per username+password combination rather than per username. But that's of course something we can change within the sql server events and triggers. Thanks, Kind Regards, Taymour

3 4

get AP MAC Address
by juliana sales porto 06 Dec '19

06 Dec '19

Hello guys, I have a question. Is that possible I take the Mac Address from RB or AP mikrotik when the user is authenticating on hotspot system? Att, Juliana Porto

3 4

Microsoft ODBC bug
by Dom Latter 06 Dec '19

06 Dec '19

Hi all, I have been experimenting with Microsoft SQL Server as a replacement for our current mysql servers [1]. I installed Microsoft's own "ODBC Driver 17 for SQL Server" and have tested against both SQL Server running on the same Linux machine as Freeradius itself, and SQL Server running on a Windows machine. In both cases I found the same (what appears to be a) bug, which I will describe below for the benefit of the archives, even though it is (probably) not a problem with freeradius. Because people hitting this are very likely to be searching with terms including "freeradius". Also there is a chance that it is somehow specific to the interaction with freeradius. Because it is hard to imagine even Microsoft releasing something with such a glaring fault. I'll also give a work-around. I think I will now try iodbc instead - anybody here used it? Right, the bug. Here's my custom attribute: ATTRIBUTE My-Int 3004 integer Here's part of the post-auth section in the "outer" site: update control { My-Int := "%{sql:SELECT 9999 }" My-Int := "%{sql:SELECT 10000 }" My-Int := "%{sql:SELECT '10000' }" Here's debug output: EXPAND %{sql:SELECT 9999 } --> 9999 My-Int := 9999 Executing select query: SELECT 10000 rlm_sql_unixodbc: 22003 [Microsoft][ODBC Driver 17 for SQL Server]Numeric value out of range ERROR: Error fetching row ERROR: Unknown error ERROR: SQL query failed: <INVALID> EXPAND %{sql:SELECT 10000 } --> My-Int := 0 Executing select query: SELECT '10000' EXPAND %{sql:SELECT '10000' } --> 10000 My-Int := 10000 As you can see, if an integer is more than four digits long, the driver throws an error. But if you return the number as a string, it works fine. I'd love to see the source code for this... [1] Everything else is SQL Server and our current integration between the two databases is rather clunky; a homogeneous environment makes sense, whatever I personally think of Microsoft <grin>.

7 26

Redundant SQL connection. Starting radiusd and Respond with Access-Accept if all databases do not work #2
by Никита Борисенков 05 Dec '19

05 Dec '19

> The task is to allow or prohibit calls to subscribers. If the subscriber > has valid status, then we send Access-Accept. If the subscriber calls > the emergency service, then we send Access-Accept. In other cases, we > send Access-Reject. > > I configured two radius server, and two sql server. Replication > configured between sql servers. > > I write accounting and authentication to the database. > > I want that when one database is unavailable, data is written to another > database. But if both databases are not available, then we send > Access-Accept > > Some questions: > * Is there a way to not duplicate config for modules sql1 and sql2 > because they differ only in ip-address? > * Is there a way to start freeradius if one or all databases are down? > * What is the correct way to verify that sql1 and sql2 modules are fail > without checking "Calling-Station-Id-Is-Exists" for empty string? > * How can I simplify this configuration? > > > My config: > > sql sql1 { > driver = "rlm_sql_mysql" > dialect = "mysql" > > server = "localhost" > port = 3306 > login = "radius" > password = "test" > > query_timeout = 5 > > radius_db = "radius" > > read_clients = no > > # Table to keep radius client info > client_table = "nas" > > # If you want both stop and start records logged to the > # same SQL table, leave this as is. If you want them in > # different tables, put the start table in acct_table1 > # and stop table in acct_table2 > acct_table1 = "radacct" > acct_table2 = "radacct" > > # Allow for storing data after authentication > postauth_table = "radpostauth" > > # Tables containing 'check' items > authcheck_table = "radcheck" > groupcheck_table = "radgroupcheck" > > # Tables containing 'reply' items > authreply_table = "radreply" > groupreply_table = "radgroupreply" > > # Table to keep group info > usergroup_table = "radusergroup" > > pool { > start = ${thread[pool].start_servers} > min = ${thread[pool].min_spare_servers} > max = ${thread[pool].max_servers} > spare = ${thread[pool].max_spare_servers} > > uses = 0 > retry_delay = 30 > lifetime = 0 > idle_timeout = 60 > } > > # This entry should be used for additional instances (sql foo {}) > # of the SQL module. > group_attribute = "${.:instance}-SQL-Group" > > # This entry should be used for the default instance (sql {}) > # of the SQL module. > #group_attribute = "SQL-Group" > > # Read database-specific queries > # $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf > $INCLUDE ${modconfdir}/sql/main/${dialect}/queries.conf > } > > sql sql2 { > driver = "rlm_sql_mysql" > dialect = "mysql" > > server = "172.27.65.243" > port = 3306 > login = "radius" > password = "test" > > query_timeout = 5 > > radius_db = "radius" > > read_clients = no > > # Table to keep radius client info > client_table = "nas" > > # If you want both stop and start records logged to the > # same SQL table, leave this as is. If you want them in > # different tables, put the start table in acct_table1 > # and stop table in acct_table2 > acct_table1 = "radacct" > acct_table2 = "radacct" > > # Allow for storing data after authentication > postauth_table = "radpostauth" > > # Tables containing 'check' items > authcheck_table = "radcheck" > groupcheck_table = "radgroupcheck" > > # Tables containing 'reply' items > authreply_table = "radreply" > groupreply_table = "radgroupreply" > > # Table to keep group info > usergroup_table = "radusergroup" > > pool { > start = ${thread[pool].start_servers} > min = ${thread[pool].min_spare_servers} > max = ${thread[pool].max_servers} > spare = ${thread[pool].max_spare_servers} > > uses = 0 > retry_delay = 30 > lifetime = 0 > idle_timeout = 60 > } > > # This entry should be used for additional instances (sql foo {}) > # of the SQL module. > group_attribute = "${.:instance}-SQL-Group" > > # This entry should be used for the default instance (sql {}) > # of the SQL module. > #group_attribute = "SQL-Group" > > # Read database-specific queries > #$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf > $INCLUDE ${modconfdir}/sql/main/${dialect}/queries.conf > } > > # Create virtual module for SELECTs > instantiate { > redundant sql1_or_sql2 { > sql1 > sql2 > } > } > > server ats_local { > authorize { > update control { > Calling-Station-Id-Status = "%{sql1_or_sql2:SELECT > gtdb_users.status FROM gtdb_users WHERE aon='%{Calling-Station-Id}'}" > Called-Station-Id-Status = "%{sql1_or_sql2:SELECT > gtdb_users.status FROM gtdb_users WHERE aon='%{Called-Station-Id}'}" > > Calling-Station-Id-Is-Exists = "%{sql1_or_sql2:SELECT > COUNT(gtdb_users.status) FROM gtdb_users WHERE > aon='%{Calling-Station-Id}'}" > Called-Station-Id-Is-Exists = "%{sql1_or_sql2:SELECT > COUNT(gtdb_users.status) FROM gtdb_users WHERE > aon='%{Called-Station-Id}'}" > > Called-Station-Id-Emergency = "%{sql1_or_sql2:SELECT > COUNT(aon) FROM emergency_cid WHERE aon='%{Called-Station-Id}'}" > } > > # These attributes in normal condition must contain the number > >= 0 (because we use sql COUNT() ) > # If there is an empty string inside, then sql queries failed > for some reason and we return Access-Accept > > if (&control:Calling-Station-Id-Is-Exists == '' || > &control:Called-Station-Id-Is-Exists == '') { > update control { > Auth-Type := Accept > } > } > else { > if (control:Called-Station-Id-Emergency == '1') { > update control { > Auth-Type := Accept > } > } > > # ... > # bunch of elsif for Calling-Station-Id-Status and > Called-Station-Id-Status > # ... > > else { > update control { > Auth-Type := Reject > } > } > } > } > > > authenticate { > } > > preacct { > acct_unique > } > > $INCLUDE ${confdir}/ats_accounting.conf > > session { > } > > post-auth { > update reply { > cisco-avpair = "h323-credit-time=86400" > } > > if (&User-Name) { > # this not work, because I can't put "ok" to virtual module > "sql1_or_sql2" > # sql1_or_sql2 > redundant { > sql1 > sql2 > ok > } > } > > Post-Auth-Type REJECT { > if (&User-Name) { > redundant { > sql1 > sql2 > ok > } > } > } > > } > > pre-proxy { > } > > post-proxy { > } > } > See raddb/templates.conf You can put all of the configuration > *except* the "server" file into a "template" in that file. Then > configure two SQL modules: > > sql sql1 { > $template sql_template > server = localhost > } > > sql sql2 { > $template sql_template > server = 172.27.65.243 > } > > > > * Is there a way to start freeradius if one or all databases are down? > > See the pool config. This is documented. Set "start = 0", and "min > = 0" > > > * What is the correct way to verify that sql1 and sql2 modules are > fail without checking "Calling-Station-Id-Is-Exists" for empty string? > > Use a "redundant" block. > > > * How can I simplify this configuration? > > It seems OK to me. > > Alan DeKok. Sorry for repeating the message, I mistakenly deleted all previous messages. Thanks for the help. Everything worked out for me. The config began to look more simple. All my problems were due to the fact that I did not read the documentation. And I also deleted all the comments from the configuration files to make it easier to read, but in the end I made it worse for myself. Now I make a copy and rename the file to "*_with_comments" to look into it if necessary.

2 1

Exec and dropped attributes between v2.0 and 3.0
by Luke Cameron 05 Dec '19

05 Dec '19

Hi All, I am upgrading a V2.0 instance to 3.0... They use EXEC to run a perl script which passes in the username and Framed-IP-Address to update there bind DNS server of the clients IP. I know Framed-IP-Address Attribute has been dropped. Has anyone got any ideas how can I achieve the same thing?

3 14

Freeradius crashes with SIGABRT
by Daniel Feuchtinger 04 Dec '19

04 Dec '19

Hi, our radius proxy crashes regularily since we switched from version 2 to 3. First we ran freeradius version 3.0.15 (package from Suse Linux Enterprise 12.4), then version 3.0.17 and 3.0.18 (compiled with rpmbuild) with no difference. Our present configuration is like this: radius@radius-dev1:~> uname -a Linux radius-dev1 4.12.14-95.6-default #1 SMP Thu Jan 17 06:04:39 UTC 2019 (6af4ef8) x86_64 x86_64 x86_64 GNU/Linux radius@radius-dev1:~> /usr/sbin/radiusd -v radiusd: FreeRADIUS Version 3.0.18, for host x86_64-suse-linux-gnu, built on Mar 4 2019 at 00:00 FreeRADIUS Version 3.0.18 I run the radius-daemon inside of gdb with dumps enabled: Starting program: /usr/sbin/radiusd -f -d /etc/raddb ... *** Error in `/usr/sbin/radiusd': double free or corruption (fasttop): 0x00007fffe8009b40 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x7411f)[0x7ffff60ba11f] /lib64/libc.so.6(+0x79596)[0x7ffff60bf596] /lib64/libc.so.6(+0x7a3db)[0x7ffff60c03db] /usr/lib64/libtalloc.so.2(+0x300d)[0x7ffff6e7a00d] /usr/lib64/libtalloc.so.2(+0x2d87)[0x7ffff6e79d87] /usr/lib64/libtalloc.so.2(+0x2d87)[0x7ffff6e79d87] /usr/sbin/radiusd(+0x37ae7)[0x55555558bae7] /usr/sbin/radiusd(+0x3a14d)[0x55555558e14d] /usr/lib64/freeradius/libfreeradius-radius.so(fr_event_run+0x74)[0x7ffff79928d4] /usr/lib64/freeradius/libfreeradius-radius.so(fr_event_loop+0x2c9)[0x7ffff7992ec9] /usr/sbin/radiusd(main+0x706)[0x555555569f06] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7ffff6066725] /usr/sbin/radiusd(_start+0x29)[0x55555556a239] Thread 1 "radiusd" received signal SIGABRT, Aborted. 0x00007ffff607af97 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 55 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) (gdb) bt #0 0x00007ffff607af97 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 #1 0x00007ffff607c36a in __GI_abort () at abort.c:78 #2 0x00007ffff60ba124 in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff61b3f48 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175 #3 0x00007ffff60bf596 in malloc_printerr (action=3, str=0x7ffff61b40a0 "double free or corruption (fasttop)", ptr=<optimized out>, ar_ptr=<optimized out>) at malloc.c:5018 #4 0x00007ffff60c03db in _int_free (av=0x7fffe8000020, p=<optimized out>, have_lock=0) at malloc.c:3872 #5 0x00007ffff6e7a00d in _tc_free_internal (tc=0x7fffe8009b40, location=0x5555555b02ea "src/main/process.c:604") at ../talloc.c:1148 #6 0x00007ffff6e79d87 in _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x7fffe801cb80, tc=0x7fffe801cb20) at ../talloc.c:1593 #7 _tc_free_internal (location=0x5555555b02ea "src/main/process.c:604", tc=0x7fffe801cb20) at ../talloc.c:1104 #8 _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x555555c80a60, tc=0x555555c80a00) at ../talloc.c:1593 #9 _tc_free_internal (tc=0x555555c80a00, location=0x5555555b02ea "src/main/process.c:604") at ../talloc.c:1104 #10 0x00007ffff6e79d87 in _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x555555c808b0, tc=0x555555c80850) at ../talloc.c:1593 #11 _tc_free_internal (location=0x5555555b02ea "src/main/process.c:604", tc=0x555555c80850) at ../talloc.c:1104 #12 _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x555555c80690, tc=0x555555c80630) at ../talloc.c:1593 #13 _tc_free_internal (tc=0x555555c80630, location=0x5555555b02ea "src/main/process.c:604") at ../talloc.c:1104 #14 0x000055555558bae7 in request_done (request=request@entry=0x555555c808b0, action=<optimized out>, action@entry=2) at src/main/process.c:899 #15 0x000055555558e14d in request_cleanup_delay (request=0x555555c808b0, action=<optimized out>) at src/main/process.c:1212 #16 0x00007ffff79928d4 in fr_event_run (el=el@entry=0x555555bd60b0, when=when@entry=0x7fffffffe350) at src/lib/event.c:309 #17 0x00007ffff7992ec9 in fr_event_loop (el=0x555555bd60b0) at src/lib/event.c:632 #18 0x0000555555569f06 in main (argc=<optimized out>, argv=<optimized out>) at src/main/radiusd.c:611 The crash occures always within a few hours, sometimes soon after startup. Version 2.x with a similar setup runs stable. I didn't provide the output of -X because it contains sensible data, but I could provide cleaned logs and configs, if needed. Thanks and greetings, Daniel

4 15

Including same directory twice is not working
by Chinnapaiyan, Nagamani 04 Dec '19

04 Dec '19

Hi, I am using 4.0.x branch(#fed87e6406e291d472c20a5cabbe7324ce7148f2). dhcp site file: recv DHCP-Discover { ... $INCLUDE ${raddbdir}/dhcp-subconfigs/devstack01/ut/subconfigs_discover/ ... } recv DHCP-Request { ... $INCLUDE ${raddbdir}/dhcp-subconfigs/devstack01/ut/subconfigs_request/ ... } recv DHCP-Inform { ... $INCLUDE ${raddbdir}/dhcp-subconfigs/devstack01/ut/subconfigs/ ... } recv DHCP-Release { ... $INCLUDE ${raddbdir}/dhcp-subconfigs/devstack01/ut/subconfigs/ ... } All these ${raddbdir}/dhcp-subconfigs/devstack01/ut/subconfigs*/ directories have same files in them. subconfigs: 1_biz.cfg 2_res.cfg 3_vut.cfg 4_sim.cfg 5_ut.cfg 6_simut.cfg subconfigs_discover: 1_biz.cfg 2_res.cfg 3_vut.cfg 4_sim.cfg 5_ut.cfg 6_simut.cfg subconfigs_request: 1_biz.cfg 2_res.cfg 3_vut.cfg 4_sim.cfg 5_ut.cfg 6_simut.cfg If directory names are different (but same files in them), INCLUDE works without any problem. But if I include same directory twice it segfaults. radius debug output: # /usr/sbin/radiusd -X Info : FreeRADIUS Version 4.0.0 Info : Copyright 1999-2019 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/etc/raddb/dictionary" including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf Including files in directory "/etc/raddb/mods-enabled/" including configuration file /etc/raddb/mods-enabled/redis including configuration file /etc/raddb/mods-enabled/redis_ippool including configuration file /etc/raddb/mods-enabled/ldap including configuration file /etc/raddb/mods-enabled/linelog_dhcp including configuration file /etc/raddb/mods-enabled/dhcpv4 including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/expr Including files in directory "/etc/raddb/policy.d/" including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/time including configuration file /etc/raddb/policy.d/vendor Including files in directory "/etc/raddb/sites-enabled/" including configuration file /etc/raddb/sites-enabled/dhcp Loaded module "proto_dhcpv4" Including files in directory "/etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/" including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/1_biz.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/2_res.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/3_vut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/4_sim.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/5_ut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/6_simut.cfg Including files in directory "/etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/" including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/1_biz.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/2_res.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/3_vut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/4_sim.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/5_ut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/6_simut.cfg Including files in directory "/etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/" including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/1_biz.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/2_res.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/3_vut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/4_sim.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/5_ut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/6_simut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack08/ut/main.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack10/ut/main.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/host/main.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack08/host/main.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack10/host/main.cfg including configuration file /etc/raddb/dhcp-subconfigs/vasn-stackids-switch.out Including files in directory "/etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/" CAUGHT SIGNAL: Segmentation fault Backtrace of last 8 frames: /usr/lib64/freeradius/libfreeradius-util.so(fr_fault+0x1ae)[0x7f0136607c2e] /lib64/libpthread.so.0(+0xf5f0)[0x7f0134e595f0] /lib64/libc.so.6(fgets+0x1b)[0x7f013467396b] /usr/lib64/freeradius/libfreeradius-server.so(cf_file_read+0x30e)[0x7f0136ccf9de] /usr/lib64/freeradius/libfreeradius-server.so(main_config_init+0x223)[0x7f0136ce8573] /usr/sbin/radiusd(main+0x526)[0x4040d6] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7f0134627505] /usr/sbin/radiusd[0x404d6d] No panic action set _EXIT(139) CALLED src/lib/util/debug.c[920]. Last error was: Invalid attribute reference, missing '&' prefix Regards, Nagamani Chinnapaiyan

2 3

802.1x dynamic vlan and remote desktop
by Luc Paulin 03 Dec '19

03 Dec '19

Hi Eveyrone, I am currently testing 802.1x dynamic vlan. So far all work great, except for remote dekstop connection. Look like RDP and dynamic vlan doesn't make a good fit, or I may not be doing it correctly. I currently do first computer authentification at bootup and then once user is logging in, user authentication is done and switch's port move to the right vlan. Look like no matter which user logged in a desktop, it's the "computer account/vlan" that has priority over the user's account/vlan. Therefore if user was already logged in his system, then decide later to do an RDP session, the system will switch to "computers" vlan subnet, which cause disconnection/dns update/replication time issues. How do you manage remote desktop and dynamic vlan within your environement? Any hint/clues on how to achieve this? -Luc -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster

2 2

Is it possible to do Vlan assignment based on what nas the login request is coming from?
by Håvard Rabbe 01 Dec '19

01 Dec '19

Hi Im testing vlan assignment on wifi. Freeradius 3 with sql. Looks like it is working ok. But I want a user to be asigned to different vlan based on what nas the login request is coming from. Is this possible? Like if user test log in on nas1 it gets vlan 100 and if the same user log in on nas2 it gets vlan 200 Any ideas? Best Regards, Håvard Rabbe Sendt fra min iPhone Sendt fra min iPhone

3 4