Tunnel-Type = VLAN
Tunnel-Medium-Type = IEEE-802
Tunnel-Private-Group-Id = VLAN_ID
It
works fine when we use the AP against the radius server, but when we
use the WLC against the Radius server the process is not getting to the
attributes assignment part, because (I guess) it's not getting something
in the Huntgroup variable.
This is the difference. The one that works:
server inner-tunnel {
+- entering group authorize {...}
++[preprocess] returns ok
++? if (!Huntgroup-Name)
? Evaluating !(Huntgroup-Name) -> FALSE
++? if (!Huntgroup-Name) -> FALSE
++? if (Huntgroup-Name == "list")
? Evaluating (Huntgroup-Name == "list") -> TRUE
++? if (Huntgroup-Name == "list") -> TRUE
++- entering if (Huntgroup-Name == "list") {...}
+++? if (Ldap-Group == "WIFI-Direccion")
"WIFI-Direccion" is the first LDAP group to check if the user is in.
The one that does not work:
server inner-tunnel {
+- entering group authorize {...}
++[preprocess] returns ok
++? if (!Huntgroup-Name)
? Evaluating !(Huntgroup-Name) -> TRUE
++? if (!Huntgroup-Name) -> TRUE
++- entering if (!Huntgroup-Name) {...}
+++[reply] returns ok
++- if (!Huntgroup-Name) returns ok
++? if (Huntgroup-Name == "list")
(Attribute Huntgroup-Name was not found)
Apart from this, I see differencies in other parts of the radius debug like this:
The one that works:
rad_recv: Access-Request packet from host 10.32.2.39 port 1645, id=199, length=136
User-Name = "fcanales"
Framed-MTU = 1400
Called-Station-Id = "001d.4551.7da0"
Calling-Station-Id = "5894.6b0d.e86c"
Service-Type = Login-User
Message-Authenticator = 0x645687565f9d60e3b76f5ffac29b74a1
EAP-Message = 0x0202000d016663616e616c6573
NAS-Port-Type = Wireless-802.11
NAS-Port = 59460
NAS-IP-Address = 10.32.2.39
NAS-Identifier = "ap-Reco32"
The one that does not work:
rad_recv: Access-Request packet from host 10.32.2.81 port 32768, id=113, length=232
User-Name = "fcanales"
Calling-Station-Id = "58-94-6b-0d-e8-6c"
Called-Station-Id = "30-37-a6-4b-9f-90:IReconquista"
NAS-Port = 1
Cisco-AVPair = "audit-session-id=0a2002510000000f4eaaf051"
NAS-IP-Address = 10.32.2.81
NAS-Identifier = "Iplan_wcs"
Airespace-Wlan-Id = 1
Service-Type = Framed-User
Framed-MTU = 1300
NAS-Port-Type = Wireless-802.11
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "60"
EAP-Message = 0x0202000d016663616e616c6573
Message-Authenticator = 0x77344c030301e2389311b1dde163a5b7
The differencies in "Calling-Station-Id", "Called-Station-Id" and " Service-Type", for example.
Is it posible that WCL is sending the information in a way that Radius cannot process?
Thanks!