how to do the dynamic VLAN rewrite according to the username or calling-station-id?
We are trying to explore the 802.1x in university resnet. One thing we want to do is put the cisco switch port in a walled garden VLAN if the username or calling-station-id match a blocklist. If username/calling-station-id is not in the blocklist, they will just get to the static access VLAN configured on the cisco switch port. Is there any module available to do this already? Regards, Shiling
Hi,
We are trying to explore the 802.1x in university resnet. One thing we want to do is put the cisco switch port in a walled garden VLAN if the username or calling-station-id match a blocklist. If username/calling-station-id is not in the blocklist, they will just get to the static access VLAN configured on the cisco switch port. Is there any module available to do this already?
use SQL, Users file or LDAP - if the user exists as a check item then set the correct Cisco VLAN return attributes. alan
On 11/6/07, A.L.M.Buxey@lboro.ac.uk <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
We are trying to explore the 802.1x in university resnet. One thing we want to do is put the cisco switch port in a walled garden VLAN if the username or calling-station-id match a blocklist. If username/calling-station-id is not in the blocklist, they will just get to the static access VLAN configured on the cisco switch port. Is there any module available to do this already?
use SQL, Users file or LDAP - if the user exists as a check item then set the correct Cisco VLAN return attributes.
Suppose we use Users file, where else in the freeradius configuration, we can check and how to rewrite the VLAN? Thanks. Shiling alan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Suppose we use Users file, where else in the freeradius configuration, we can check and how to rewrite the VLAN?
Thanks.
Shiling
alan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Nowhere. Put these as reply attributes: Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = vlannumber Ivan Kalik Kalik informatika ISP
On 11/6/07, tnt@kalik.co.yu <tnt@kalik.co.yu> wrote:
Suppose we use Users file, where else in the freeradius configuration, we can check and how to rewrite the VLAN?
Thanks.
Shiling
alan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Nowhere. Put these as reply attributes:
Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = vlannumber
Thanks for this info. One more step, is there any place in the freeradius configuration file that we can run a script to check the incoming radius request user-name/calling-station-id agaist a file for example youAreBlocked.txt, and then set the above attributes in the reply to the NAS? Shiling Ivan Kalik
Kalik informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
You should seriously think about using (sql or ldap) groups. You than have one setting for blocked group, one for the others. If you are keen on scripts => exec module. Ivan Kalik Kalik Informatika ISP Dana 6/11/2007, "schilling" <schilling2006@gmail.com> piše:
On 11/6/07, tnt@kalik.co.yu <tnt@kalik.co.yu> wrote:
Suppose we use Users file, where else in the freeradius configuration, we can check and how to rewrite the VLAN?
Thanks.
Shiling
alan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Nowhere. Put these as reply attributes:
Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = vlannumber
Thanks for this info. One more step, is there any place in the freeradius configuration file that we can run a script to check the incoming radius request user-name/calling-station-id agaist a file for example youAreBlocked.txt, and then set the above attributes in the reply to the NAS?
Shiling
Ivan Kalik
Kalik informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
Thanks for this info. One more step, is there any place in the freeradius configuration file that we can run a script to check the incoming radius request user-name/calling-station-id agaist a file for example youAreBlocked.txt, and then set the above attributes in the reply to the NAS?
rlm_perl, rlm_python or exec - which coding language would you prefer? with any of these you can simply run a script which could check the attributes and return the correct reply attributes. alan
On Nov 6, 2007 5:29 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
Thanks for this info. One more step, is there any place in the freeradius configuration file that we can run a script to check the incoming radius request user-name/calling-station-id agaist a file for example youAreBlocked.txt, and then set the above attributes in the reply to the NAS?
rlm_perl, rlm_python or exec - which coding language would you prefer? with any of these you can simply run a script which could check the attributes and return the correct reply attributes.
This is what I am looking for. Thanks a lot. Getting to more specifics. We already have enterprise LDAP service. Can we just add an attribute to the user entry in the ldap which will like blocked = yes, then we can have the rlm_perl check the ldap user entry attribute, if blocked == yes, then assign the restricted VLAN name in the radius reply. Is this normal thing to do? Or have a group in ldap for blocked users, if user entry group include the blocked group, then assign restricted VLAN in the radius reply? I think either way should work. Thanks for all the reply. Regards, shiling
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
Suppose we use Users file, where else in the freeradius configuration, we can check and how to rewrite the VLAN?
if you use the users file, simply add the required VLAN attributes as part of the return reply - check the users file for similar examples. alan
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
schilling -
tnt＠kalik.co.yu