Are you sure that you don't want these to be reply attributes? Show debug to see what's coming through. alan On 30 Jan 2018 11:10 am, "Vacheslav" <m_zouhairy@skno.by> wrote:
Thanks for the tip. According to https://supportforums.cisco.com/t5/other-security- subjects/802-1x-authentication-not-happening-in-voice-domain-for-ip-phone/ td-p/1652836 These need to be added cisco-avpair="device-traffic-class=voice" Tunnel-Type=1:VLAN Tunnel-Medium-Type=1:802 Tunnel-Private-Group-ID=1:VOICE-LAN
So I added them as check attributes, with := but I got: Auth: (163) Invalid user (sql: Error parsing value: Unknown or invalid value "1:VLAN" for attribute Tunnel-Type): [ip phone name/<via Auth-Type = eap>] (from client Switch port 50145 cli mac) Tue Jan 30 13:36:34 2018 : Auth: (163) Login incorrect (sql: Error parsing value: Unknown or invalid value "1:VLAN" for attribute Tunnel-Type): [ip phone name/<via Auth-Type = eap>] (from client Switch port 50145 cli mac) If I delete the attribute Tunnel-Type:=1:VLAN (and it does not matter if I set it as a reply attribute, same error) I get: Auth: (159) Invalid user (sql: Error parsing value: Unknown or invalid value "1:802" for attribute Tunnel-Medium-Type): [ip phone name<via Auth-Type = eap>] (from client Switch port 50145 cli mac) Tue Jan 30 13:34:30 2018 : Auth: (159) Login incorrect (sql: Error parsing value: Unknown or invalid value "1:802" for attribute Tunnel-Medium-Type): [ip phone name/<via Auth-Type = eap>] (from client Switch port 50145 cli mac) The progress is that the ip phone now shows dropping packets on the voice vlan which means it accepted: Tunnel-Private-Group-ID:=1:VOICE-LAN After reading an email here: I'm inclined to replace ":=" with = but I have a limited lunch break to test these settings each day so perhaps someone who has dealt with this can save me some wasted time?
-----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+m_zouhairy= skno.by@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, January 26, 2018 4:07 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: cisco phones
On Jan 26, 2018, at 6:49 AM, Vacheslav <m_zouhairy@skno.by> wrote:
I still can't authenticate the ip phones using md5 on the voice vlan,
they keep getting authenticated on the data vlan. I ducked ducked the internet and found that:
"device-traffic-class=voice:= Cisco-AVPair" Must be added. So I added it username of the ip phone in daloradius but the behavior has not changed. Perhaps, that must be added manually to the users file for it work. I only found documentation on how to do that in cisco ACS.
That documentation tells you what attributes to return, and what values to use for those attributes. Do the same thing in FreeRADIUS.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html