I read man unlang but to be honest I din't find it really useful for me.

However in "users" I found that DEFAULT or Fall-Through could be used if I have no entry for username.

What I need to do is autetificate everyone.

I have couple of users as user "admin" and for that users I creat entries like this one:

"admin" Cleartext-Password := "admin"

Tunnel-Type = VLAN,

Tunnel-Medium-Type = IEEE-802,

Tunnel-Private-Group-Id = 53,

Tunnel-Preference = 0x000000

Then all other users I need to place into VLAN 54. So at the end of file I thought entry like this could be ok to pass absolutely everyone:

"DEFAULT"

Tunnel-Type = VLAN,

Tunnel-Medium-Type = IEEE-802,

Fall-Through = Yes, #tried with/without

Tunnel-Private-Group-Id = 54,

Tunnel-Preference = 0x000000

But this and all others I tried didn't work.

Wireless network is [WPA/TKIP + WPA2/AES][Auth(802.1X)].

Have you any dvice how to fix it?

2014-07-02 10:11 GMT+02:00 <A.L.M.Buxey@lboro.ac.uk>:

Hi,

> I am using FreeRADIUS together with WLC from Cisco.
> I have 1 WLAN connected to 2 VLANs and I need to assign user into VLAN
> based on successful pass AAA or not. By that I mean to separate guests and
> members.
> How can I achieve that?
> For now I am using "users" as source of members.
> I came up wtih this
> "admin" Cleartext-Password := "admin"
> Tunnel-Type = VLAN,
> Tunnel-Medium-Type = IEEE-802,
> Tunnel-Private-Group-Id = 52,
> Tunnel-Preference = 0x000000
> to assign member into VLAN 52 but I strugle with assigning VLAN for user
> without certificate or password (I need two variants based on certificate
> and PEAP, two different servers).

well, using the RADIUS attributes, which you have done, is the way to do it.
how you do it with your users is down to your policies. you'll probably end up
using unlang in the post-auth phase (man unlang)

however, if this is an EAP/802.1X wireless network you cant do much if they fail.

alan
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Martin Hrabovský

5ZP031