How to force tunnel-xx information in access-accept packet ?
Hi I'm very new to this discuss list, and I subscribed because one of my customers have some problem with freeradius and our switches. I'm using version freeradius2-2.1.12-5.el5 ( on CentOS 511) with a Dell Networking Switch model N3024, and I want to assign the users in specific Vlans based on EAP authentication. If the user's PC is authenticated with its MAC address ( MAB option on the switch) , there are very few Radius Packet exchange and the final access-accept packet contains correctly the Tunnel-Private-Group-ID, tunnel-Type and Tunnel-Medium-type informations But when I want to authenticate the users ( using login and paswsord ), there are a lot of access-challenge packet and the final access-accept packet does not contain anymore the tunnel-Private-group-id, etc informations. Is there a way to force freeradius to include again the missing information in the Access-accept packet ? Which file(s) need to be modify and how ? Many thanks in advance for your answers Best regards Michel MONCHATRE Dell | Enterprise Solutions, Networking NSE Mobile : +33 (0)6 70 48 25 78 Dell, 8 avenue du Stade de France 93218 Saint Denis Michel_monchatre@dell.com<mailto:Michel_monchatre@dell.com> Dell S.A, Siège Social 1 rond point Benjamin Franklin 34000 Montpellier. Capital 1,782,769 Euros, 351 528 229 RCS Montpellier –APE 4651Z -TVA Intracommunautaire FR 20 351 528 229. SIRET 351 528 229 00096
On Thu, Nov 19, 2015 at 08:59:09AM +0000, Michel_Monchatre@dell.com wrote:
I'm using version freeradius2-2.1.12-5.el5 ( on CentOS 511) with a Dell Networking Switch model N3024, and I want to assign the users in specific Vlans based on EAP authentication.
That version is very old. You should really upgrade to at least the latest 2.2 version (but v2 is end of life now).
If the user's PC is authenticated with its MAC address ( MAB option on the switch) , there are very few Radius Packet exchange and the final access-accept packet contains correctly the Tunnel-Private-Group-ID, tunnel-Type and Tunnel-Medium-type informations
OK.
But when I want to authenticate the users ( using login and paswsord ), there are a lot of access-challenge packet and the final access-accept packet does not contain anymore the tunnel-Private-group-id, etc informations.
Is there a way to force freeradius to include again the missing information in the Access-accept packet ?
Many ways. It depends on where you want to get the information from, for example. Where does the existing data for MAC auth come from? The users file? A database?
Which file(s) need to be modify and how ?
Depends on the above. Could be the users file for the simplest option. You should send debug output (radiusd -X) for a working example and one that doesn't work at least so we have some idea on what you're doing. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi Matthew Thanks for your answer, I'll then install an up-to-date Linux OS with an up-to-date freeradius version and let you know about the results asap .. Best regards Michel -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+michel_monchatre=dell.com@lists.freeradius.org] On Behalf Of Matthew Newton Sent: jeudi 19 novembre 2015 13:45 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: How to force tunnel-xx information in access-accept packet ? On Thu, Nov 19, 2015 at 08:59:09AM +0000, Michel_Monchatre@dell.com wrote:
I'm using version freeradius2-2.1.12-5.el5 ( on CentOS 511) with a Dell Networking Switch model N3024, and I want to assign the users in specific Vlans based on EAP authentication.
That version is very old. You should really upgrade to at least the latest 2.2 version (but v2 is end of life now).
If the user's PC is authenticated with its MAC address ( MAB option on the switch) , there are very few Radius Packet exchange and the final access-accept packet contains correctly the Tunnel-Private-Group-ID, tunnel-Type and Tunnel-Medium-type informations
OK.
But when I want to authenticate the users ( using login and paswsord ), there are a lot of access-challenge packet and the final access-accept packet does not contain anymore the tunnel-Private-group-id, etc informations.
Is there a way to force freeradius to include again the missing information in the Access-accept packet ?
Many ways. It depends on where you want to get the information from, for example. Where does the existing data for MAC auth come from? The users file? A database?
Which file(s) need to be modify and how ?
Depends on the above. Could be the users file for the simplest option. You should send debug output (radiusd -X) for a working example and one that doesn't work at least so we have some idea on what you're doing. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Dell S.A, Siège Social 1 rond point Benjamin Franklin 34000 Montpellier. Capital 1,782,769 Euros, 351 528 229 RCS Montpellier –APE 4651Z -TVA Intracommunautaire FR 20 351 528 229. SIRET 351 528 229 00096
Hi Here I am again, sorry for the delay... I have now installed Freeradius 3.0.3 on CentOS 7.0 and got the same problem: the access-accept packet does not include anymore the tunnel-Private-group-id information... Does anyone have an idea to force freeradius to include the vlan information in the access-accept packet ? Many thanks in advance for your answers /Michel -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+michel_monchatre=dell.com@lists.freeradius.org] On Behalf Of Monchatre, Michel Sent: lundi 23 novembre 2015 07:38 To: freeradius-users@lists.freeradius.org Subject: RE: How to force tunnel-xx information in access-accept packet ? Hi Matthew Thanks for your answer, I'll then install an up-to-date Linux OS with an up-to-date freeradius version and let you know about the results asap .. Best regards Michel -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+michel_monchatre=dell.com@lists.freeradius.org] On Behalf Of Matthew Newton Sent: jeudi 19 novembre 2015 13:45 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: How to force tunnel-xx information in access-accept packet ? On Thu, Nov 19, 2015 at 08:59:09AM +0000, Michel_Monchatre@dell.com wrote:
I'm using version freeradius2-2.1.12-5.el5 ( on CentOS 511) with a Dell Networking Switch model N3024, and I want to assign the users in specific Vlans based on EAP authentication.
That version is very old. You should really upgrade to at least the latest 2.2 version (but v2 is end of life now).
If the user's PC is authenticated with its MAC address ( MAB option on the switch) , there are very few Radius Packet exchange and the final access-accept packet contains correctly the Tunnel-Private-Group-ID, tunnel-Type and Tunnel-Medium-type informations
OK.
But when I want to authenticate the users ( using login and paswsord ), there are a lot of access-challenge packet and the final access-accept packet does not contain anymore the tunnel-Private-group-id, etc informations.
Is there a way to force freeradius to include again the missing information in the Access-accept packet ?
Many ways. It depends on where you want to get the information from, for example. Where does the existing data for MAC auth come from? The users file? A database?
Which file(s) need to be modify and how ?
Depends on the above. Could be the users file for the simplest option. You should send debug output (radiusd -X) for a working example and one that doesn't work at least so we have some idea on what you're doing. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Dell S.A, Siège Social 1 rond point Benjamin Franklin 34000 Montpellier. Capital 1,782,769 Euros, 351 528 229 RCS Montpellier –APE 4651Z -TVA Intracommunautaire FR 20 351 528 229. SIRET 351 528 229 00096 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Dell S.A, Siège Social 1 rond point Benjamin Franklin 34000 Montpellier. Capital 1,782,769 Euros, 351 528 229 RCS Montpellier –APE 4651Z -TVA Intracommunautaire FR 20 351 528 229. SIRET 351 528 229 00096
On Dec 14, 2015, at 2:16 PM, <Michel_Monchatre@dell.com> <Michel_Monchatre@dell.com> wrote:
I have now installed Freeradius 3.0.3 on CentOS 7.0 and got the same problem: the access-accept packet does not include anymore the tunnel-Private-group-id information...
Version 3.0.3 is nowhere near recent.
Does anyone have an idea to force freeradius to include the vlan information in the access-accept packet ?
Configure it to include the VLAN information. It's that easy. If it's not including the VLAN information, run it in debugging mode to see what it's doing. Alan DeKok.
Hi Forget my question, I finally have it working, I just had to comment the following line “return = ok” in the default file located in sites-available : [cid:image001.jpg@01D136BB.667F5460] Best regards Michel -----Original Message----- From: Monchatre, Michel Sent: lundi 14 décembre 2015 20:06 To: freeradius-users@lists.freeradius.org Subject: RE: How to force tunnel-xx information in access-accept packet ? Hi Here I am again, sorry for the delay... I have now installed Freeradius 3.0.3 on CentOS 7.0 and got the same problem: the access-accept packet does not include anymore the tunnel-Private-group-id information... Does anyone have an idea to force freeradius to include the vlan information in the access-accept packet ? Many thanks in advance for your answers /Michel -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+michel_monchatre=dell.com@lists.freeradius.org] On Behalf Of Monchatre, Michel Sent: lundi 23 novembre 2015 07:38 To: freeradius-users@lists.freeradius.org<mailto:freeradius-users@lists.freeradius.org> Subject: RE: How to force tunnel-xx information in access-accept packet ? Hi Matthew Thanks for your answer, I'll then install an up-to-date Linux OS with an up-to-date freeradius version and let you know about the results asap .. Best regards Michel -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+michel_monchatre=dell.com@lists.freeradius.org] On Behalf Of Matthew Newton Sent: jeudi 19 novembre 2015 13:45 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org<mailto:freeradius-users@lists.freeradius.org>> Subject: Re: How to force tunnel-xx information in access-accept packet ? On Thu, Nov 19, 2015 at 08:59:09AM +0000, Michel_Monchatre@dell.com<mailto:Michel_Monchatre@dell.com> wrote:
I'm using version freeradius2-2.1.12-5.el5 ( on CentOS 511) with a
Dell Networking Switch model N3024, and I want to assign the users in
specific Vlans based on EAP authentication.
That version is very old. You should really upgrade to at least the latest 2.2 version (but v2 is end of life now).
If the user's PC is authenticated with its MAC address ( MAB option on
the switch) , there are very few Radius Packet exchange and the final
access-accept packet contains correctly the Tunnel-Private-Group-ID,
tunnel-Type and Tunnel-Medium-type informations
OK.
But when I want to authenticate the users ( using login and paswsord
), there are a lot of access-challenge packet and the final
access-accept packet does not contain anymore the
tunnel-Private-group-id, etc informations.
Is there a way to force freeradius to include again the missing
information in the Access-accept packet ?
Many ways. It depends on where you want to get the information from, for example. Where does the existing data for MAC auth come from? The users file? A database?
Which file(s) need to be modify and how ?
Depends on the above. Could be the users file for the simplest option. You should send debug output (radiusd -X) for a working example and one that doesn't work at least so we have some idea on what you're doing. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk<mailto:mcn4@le.ac.uk>> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk<mailto:ithelp@le.ac.uk>> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Dell S.A, Siège Social 1 rond point Benjamin Franklin 34000 Montpellier. Capital 1,782,769 Euros, 351 528 229 RCS Montpellier –APE 4651Z -TVA Intracommunautaire FR 20 351 528 229. SIRET 351 528 229 00096 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Dell S.A, Siège Social 1 rond point Benjamin Franklin 34000 Montpellier. Capital 1,782,769 Euros, 351 528 229 RCS Montpellier –APE 4651Z -TVA Intracommunautaire FR 20 351 528 229. SIRET 351 528 229 00096
On Mon, Dec 14, 2015 at 09:04:30PM +0000, Michel_Monchatre@dell.com wrote:
Forget my question, I finally have it working, I just had to comment the following line “return = ok” in the default file located in sites-available :
If you had included the full debug output the first time around this would have been easy to see. :-( Nevertheless - glad you got it working! Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
participants (3)
-
Alan DeKok -
Matthew Newton -
Michel_Monchatre＠dell.com