On Fri, Mar 29, 2013 at 11:20 PM, Mehdi Ravanbakhsh <babakco@gmail.com> wrote:

Dear Fajar

thanks for your replay

I have about 300 request per second in my router , so i should accept
all incoming connection , but if user not define or should be rejected
i should change IP pool to user can not access to internet and just
redirect to help paje.

in all section i change or rewrite policy to not reject the and just
change ip pool but if user not define what should i do ?

IIRC routers with 802.1x should have settings to assign users to default, restricted vlan when they're haven't authenticated yet. I suggest you look into this one first.

As for radius side, you need to make sure that your users ONLY use PAP or TTLS/PAP. If you can enforce that, then you can accept all users regardless of their user/password combination.

However usually (e.g. when majority of your users use Windows and its built-in supplicant) you'd also need EAP-PEAP-MSCHAPv2, in which case there's no way to do what you want.

Fajar