On Wed, Oct 25, 2017 at 8:44 AM, Germán Espinoza Tuesta <gr._et@hotmail.com> wrote:
Most of dynamic VLAN assignment implementations use these RADIUS attributes to work:
Tunnel-Medium-Type = 6, #IEEE-802
Tunnel-Private-Group-Id = "100"
Is there a way for freeradius to return multiple values in Tunnel-Private-Group-Id.
I'm working in a project where I want a user to belong to multiple vlans. At the moment, working with a sql database.
This really depends more on what your specific NASes/clients can do than if FreeRADIUS can return multiple attribute-value-pairs. Since Tunnel-Private-Group-Id is a string - some device vendors support a syntax in the returned string that allows for tagging/multiple VLANs. An example for a Foundry/Brocade/Ruckus ICX/Arris is something like this: Tunnel-Private-Group-Id = "t:101;t:102;t:103;t:555;t:workstations" This will cause the port to be tagged in VLANs 101, 102, 103, 555, and whatever the VLAN named 'workstations' is on the switch (which can differ in 802.1q tag value per switch that authenticates). What vendor/NAS devices are you using? Have you checked with the vendor to determine what attribute-value-pairs they are expecting and if they support a tagging syntax? I have not seen much consistency in this area with other vendors - it seems most just stop at implementing the basics of 'We support dynamic VLAN via RADIUS' by allowing you to specify a VLAN ID for untagged traffic. -- jason