On Nov 16, 2018, at 5:13 PM, Victor Cenac <victor@fuller.edu> wrote:
I have a Juniper network where we assign devices to vlans based on their MAC. The MACS are stored in an LDAP with the MAC as username and password. The group membership is what distinguishes the vlan needed.
That should be simple enough,
I managed to configure the ldap and enable the ldap module. FreeRADIUS starts fine with it. I also added all the switches as clients.
OK.
I need help figuring out: 1. Where do I tell FreeRADIUS to look for users in ldap (vs the users file)?
raddb/sites-enabled/default Look for "ldap". And, raddb/mods-available/ldap See also http://wiki.freeradius.org/. Search for "ldap". It has lots of documentations.
2. Where do I match the group in ldap with the vlan number that needs to be sent to the client (switch)? For example, for group Staff value is 10 (vlan 10).
You don't map LDAP names directly to VLANs. They might be "sales", and you can't use "sales" as a VLAN number. Instead, do this: if (LDAP-Group == "staff") { update reply { Tunnel Type = VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := 10 } } Alan DeKok.