Dynamic VLAN - limiting switchs VLANs?
Hello all, I currently have FR running and happily doing MAC authentication against a MYSQL DB. I can plug a computer into the switch, have the switch grab the MAC addy, pass it to FR, hit the DB and return what VLAN that MAC belongs to, and then have the switch configure to port to the correct VLAN. Now the complication that I'm facing is that in our environment, a MAC might be assigned to multiple VLANs and our switches only have a fraction of the total number VLANs trunked to them. What I need is a way FR can not only match the MAC to a VLAN, but also to cross reference that result to the VLANs that are available from the requesting switch. Anyone know how to do this? Or at least a good place that I can start? I'll admit that I'm very noob-ish about all this and it's is my first time trying to setup FR so I apologize if this is a really simple or conversely an impossible task. I just can not get Google to give me any love on this. Thanks, Rob
Hi,
What I need is a way FR can not only match the MAC to a VLAN, but also to cross reference that result to the VLANs that are available from the requesting switch.
either use larger queries or use an extrenal perl or php script to do the work in your DB you'd need to add a few more columns...and dont forget to index your tables! alan
Robert wrote:
Hello all,
I currently have FR running and happily doing MAC authentication against a MYSQL DB.
I can plug a computer into the switch, have the switch grab the MAC addy, pass it to FR, hit the DB and return what VLAN that MAC belongs to, and then have the switch configure to port to the correct VLAN.
Now the complication that I'm facing is that in our environment, a MAC might be assigned to multiple VLANs and our switches only have a fraction of the total number VLANs trunked to them.
What I need is a way FR can not only match the MAC to a VLAN, but also to cross reference that result to the VLANs that are available from the requesting switch.
If your switches are groups into relatively few sets with the same vlans (e.g. buildings) then you can use an rlm_passwd to map NAS-IP-Address to My-Switch-Group, an rlm_passwd to match Calling-Station-Id to My-Client-Group then in "users": DEFAULT My-Switch-Group == "building1", My-Client-Group == "BANNED" Tunnel-Private-Group-Id = 123 ...etc. Best would be to use SQL though ("select * from stored_procedure") or an external script (Exec-Program)
Phil Mayers wrote:
Robert wrote:
Hello all,
I currently have FR running and happily doing MAC authentication against a MYSQL DB.
I can plug a computer into the switch, have the switch grab the MAC addy, pass it to FR, hit the DB and return what VLAN that MAC belongs to, and then have the switch configure to port to the correct VLAN.
Now the complication that I'm facing is that in our environment, a MAC might be assigned to multiple VLANs and our switches only have a fraction of the total number VLANs trunked to them.
What I need is a way FR can not only match the MAC to a VLAN, but also to cross reference that result to the VLANs that are available from the requesting switch.
If your switches are groups into relatively few sets with the same vlans (e.g. buildings) then you can use an rlm_passwd to map NAS-IP-Address to My-Switch-Group, an rlm_passwd to match Calling-Station-Id to My-Client-Group then in "users":
DEFAULT My-Switch-Group == "building1", My-Client-Group == "BANNED" Tunnel-Private-Group-Id = 123
...etc.
Best would be to use SQL though ("select * from stored_procedure") or an external script (Exec-Program)
The other way to do it is to use SQL xlat, and a second hints file to write SQL return values into the request packet. DEFAULT My-Switch-Group = "%{sql:SELECT switch_group FROM `where_ever` WHERE ip = %{NAS-IP-Address}}" When stored procedures are sorted you should be able to get results from them in the same way ... -- Arran
Robert wrote:
I can plug a computer into the switch, have the switch grab the MAC addy, pass it to FR, hit the DB and return what VLAN that MAC belongs to, and then have the switch configure to port to the correct VLAN.
Now the complication that I'm facing is that in our environment, a MAC might be assigned to multiple VLANs and our switches only have a fraction of the total number VLANs trunked to them.
What I need is a way FR can not only match the MAC to a VLAN, but also to cross reference that result to the VLANs that are available from the requesting switch.
Anyone know how to do this? Or at least a good place that I can start?
Create an SQL table containing the relationships, and SELECT the appropriate one. Test it with the MySQL command-line tool first, and once you have the table && select set up right, transfer the SELECT to FreeRADIUS. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan Dekok -
Arran Cudbard-Bell -
Phil Mayers -
Robert