Hi, Does anyone have any idea about what attribute to use to return parameter to Cisco WLC for Interface group assignment instead of Tunnel-Private-Group-Id which just returned the VLAN ID. Best Regards Clement -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org] On Behalf Of Stefan Winter Sent: 06 April 2016 08:31 To: freeradius-users@lists.freeradius.org Subject: Re: using SSL certs with EAP-TLS Hi,
No. If your server certificate is from a CA, the client can verify that your server is genuine (if the client side is configured correctly to actually check CA and server name). With using client: you mean the RADIUS explanation of client? Like the Access Point? or the WLAN device, like a smartphone?
In this context, I meant the WLAN device.
Since there's no need to go down that route: don't. Issue client certificates from your own self-signed CA, and hand out client certs only to your own account holders. Then, no further checks are needed. Ok, thanks. I will reconsider. It's not that I am too lame to generate new certs and then import them to a handful devices. It's more that I like it that the same client cert in iOS can be used for S/MIME and for auth with WPA2 Enterprise.
Ah, well that's a reason for using a commercial CA for the client certs indeed. As others have pointed out, attributes like TLS-Client-Cert-CN can be used to compare the cert name against a list of known-good names. Of course you'll have to manage that list of names yourself in config; on a scale of "handful" that's not a problem I guess. But on a larger scale, it will get bothersome. Greetings, Stefan Winter
Yes. There are examples in the shipped tarball of FreeRADIUS for that I think. That does not mean that it's the best idea to go down that route. I'll look into that (I think it has something to do with the by Alan suggested check_cert_cn).
When you write above that you can use whatever string you like then probably you didn't try this at a remote hotspot. :-) Thats correct :D. In fact, last week was the first time I experienced WPA2 Enterprise and only with one (my own) AP.
Cheers!
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html