Version 1.1.6 - Mac Address Authentication/vlan tagging
Hello all, I wasn't able to find an answer to this on the archives. Now, here is the set up: Freeradius Ver. 1.1.6 on centOS V.5. I am testing a Cisco 2000 Series Wireless LAN Controller and am trying to figure out a way to put unknown users (via their MAC Address) into a limited access vlan. So here is the kicker, I have to be able to tell radius that users that fail to authenticate get tagged with a certain vlan tag (ie vlan ID of our limited access vlan) Can freeradius do that? Regards, Brian _____________________ Brian Ertel Network Administrator Amherst College 413-542-8320 bsertel@amherst.edu _____________________
Brian Ertel wrote:
I wasn't able to find an answer to this on the archives. Now, here is the set up: Freeradius Ver. 1.1.6 on centOS V.5. I am testing a Cisco 2000 Series Wireless LAN Controller and am trying to figure out a way to put unknown users (via their MAC Address) into a limited access vlan. So here is the kicker, I have to be able to tell radius that users that fail to authenticate get tagged with a certain vlan tag (ie vlan ID of our limited access vlan) Can freeradius do that?
Yes. Where are the known MAC's stored? In a databise? Flat-text files? Knowing that helps to design a solution. Alan DeKok.
Well, after I can get unknown users to be assigned to a limited access/registration vlan they will then register their MAC address and it will be stored in our Netreg machine which may stor the macs at text, but I will have to check with my systems guy. If I can get unknown users into the afformentioned vlan however I think I can say with a fair amount of confidence that I can make this system work. Once then register and their MAC address becomes "known" they can be given a dhcp address from what ever vlan we choose. It is firstly a matter me getting up to speed on how to config Radius to deliver vlan ID's to "unknown" users, once I can do that I can captive portal them and treat them like all other users registering on our network... I think. Thank you! Brian ________________________________ From: freeradius-users-bounces+bsertel=amherst.edu@lists.freeradius.org on behalf of Alan DeKok Sent: Sat 6/23/2007 2:51 AM To: FreeRadius users mailing list Subject: Re: Version 1.1.6 - Mac Address Authentication/vlan tagging Brian Ertel wrote:
I wasn't able to find an answer to this on the archives. Now, here is the set up: Freeradius Ver. 1.1.6 on centOS V.5. I am testing a Cisco 2000 Series Wireless LAN Controller and am trying to figure out a way to put unknown users (via their MAC Address) into a limited access vlan. So here is the kicker, I have to be able to tell radius that users that fail to authenticate get tagged with a certain vlan tag (ie vlan ID of our limited access vlan) Can freeradius do that?
Yes. Where are the known MAC's stored? In a databise? Flat-text files? Knowing that helps to design a solution. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Which file do I need to modify to assign vlan tags to unknown mac addresses? Thanks, Brian -----Original Message----- From: freeradius-users-bounces+bsertel=amherst.edu@lists.freeradius.org [mailto:freeradius-users-bounces+bsertel=amherst.edu@lists.freeradius.or g] On Behalf Of Alan DeKok Sent: Saturday, June 23, 2007 2:51 AM To: FreeRadius users mailing list Subject: Re: Version 1.1.6 - Mac Address Authentication/vlan tagging Brian Ertel wrote:
I wasn't able to find an answer to this on the archives. Now, here is the set up: Freeradius Ver. 1.1.6 on centOS V.5. I am testing a Cisco 2000 Series Wireless LAN Controller and am trying to figure out a way to put unknown users (via their MAC Address) into a limited access vlan. So here is the kicker, I have to be able to tell radius that users that fail to authenticate get tagged with a certain vlan tag (ie vlan ID of our limited access vlan) Can freeradius do that?
Yes. Where are the known MAC's stored? In a databise? Flat-text files? Knowing that helps to design a solution. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Brian Ertel wrote:
Which file do I need to modify to assign vlan tags to unknown mac addresses?
The "users" file. You have to tell the server to accept the request, and then assign the RADIUS attributes that put it into a VLAN. See your NAS documentation for how to assign VLANs. Alan DeKok.
Thank you Alan -----Original Message----- From: freeradius-users-bounces+bsertel=amherst.edu@lists.freeradius.org [mailto:freeradius-users-bounces+bsertel=amherst.edu@lists.freeradius.or g] On Behalf Of Alan DeKok Sent: Wednesday, June 27, 2007 9:46 AM To: FreeRadius users mailing list Subject: Re: Version 1.1.6 - Mac Address Authentication/vlan tagging Brian Ertel wrote:
Which file do I need to modify to assign vlan tags to unknown mac addresses?
The "users" file. You have to tell the server to accept the request, and then assign the RADIUS attributes that put it into a VLAN. See your NAS documentation for how to assign VLANs. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Seems like everyday from one upstream provider we use I get accouting record start and for some reason i get no stop packet on customers. I also use same radius with YourNetPlus and I am not seeing this issue with them. So it leads me to believe its something between I and GlobalPOPS. My question is mysql programming knowledge is not that strong does anyone know of a query I could run every so often that would cleanup the raddact table of records as such. For example I would like to clear all records with start time greater than 5 hours old from the time the query runs with no stop time. I have session tme out of 4 hours so there is not much chance that a user is still connected. At least that way my users online listing, etc won't be cluttered with old users on, and possibly be blocking a user access due to it thinking they are still connected. I know globalpops is going to tell me this is latency on our network and not theirs. But if that was the case I would see several happen from the yournetplus network also.
Do first "select * from ..." to check if those are the records you want deleted: DELETE FROM radacct WHERE AcctStopTime=0 AND AcctStartTime < DATE_SUB(NOW(), INTERVAL 5 HOUR) Ivan Kalik Kalik Informatika ISP Dana 27/6/2007, "Jeff" <jeffa@jahelpdesk.com> piše:
Seems like everyday from one upstream provider we use I get accouting record start and for some reason i get no stop packet on customers. I also use same radius with YourNetPlus and I am not seeing this issue with them. So it leads me to believe its something between I and GlobalPOPS. My question is mysql programming knowledge is not that strong does anyone know of a query I could run every so often that would cleanup the raddact table of records as such.
For example I would like to clear all records with start time greater than 5 hours old from the time the query runs with no stop time. I have session tme out of 4 hours so there is not much chance that a user is still connected. At least that way my users online listing, etc won't be cluttered with old users on, and possibly be blocking a user access due to it thinking they are still connected.
I know globalpops is going to tell me this is latency on our network and not theirs. But if that was the case I would see several happen from the yournetplus network also.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Brian Ertel -
Jeff -
tnt＠kalik.co.yu