Hi to all, my question is if it's possible to log the end of a 802.1x session. I need this log for legal reason. I need the start session log which i can get by a mysql query in post-auth session. For the end of 802.1x session? Any ideas? Can freeradius do this in someway? Thanks for answers. Regards -- Rosario L.
Rosario Lumia wrote:
Hi to all,
my question is if it's possible to log the end of a 802.1x session.
What does that mean?
I need this log for legal reason. I need the start session log which i can get by a mysql query in post-auth session. For the end of 802.1x session? Any ideas? Can freeradius do this in someway?
See the FAQ. FreeRADIUS can log any information that the Access Point sends. If it doesn't send anything... FreeRADIUS can't log it. Alan DeKok.
2010/4/9 Alan DeKok <aland@deployingradius.com>
Rosario Lumia wrote:
Hi to all,
my question is if it's possible to log the end of a 802.1x session.
What does that mean?
Sorry for my (very) bad english. Only for clearness: I'd want to know if there is a way to log the end of a 802.1x session. I mean: a client turn off his wireless card and (I think) AP can (??) send a message to freeradius because the association between client and AP is lost. My question was: is it possible? Your answer was very clear. Thank you Regards Rosario
I need this log for legal reason. I need the start session log which i can get by a mysql query in post-auth session. For the end of 802.1x session? Any ideas? Can freeradius do this in someway?
See the FAQ. FreeRADIUS can log any information that the Access Point sends. If it doesn't send anything... FreeRADIUS can't log it.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Rosario L.
On Fri, Apr 9, 2010 at 8:46 AM, Rosario Lumia <eryter@gmail.com> wrote:
Sorry for my (very) bad english. Only for clearness: I'd want to know if there is a way to log the end of a 802.1x session. I mean: a client turn off his wireless card and (I think) AP can (??) send a message to freeradius because the association between client and AP is lost. My question was: is it possible? Your answer was very clear.
Answer: probably not.
From what I've read, supplicants can send an EAPOL-Logoff message to an authenticator (ie. an AP/switch). The authenticator could then disable the "port." I can't think of any good reason the authenticator would send this message to RADIUS. I've also read that Windows clients will send an EAPOL-Start message when a user logs off instead of an EAPOL-Logoff. Neither of these are really good methods for determining whether an association between a client and an AP is lost.
-M
From what I've read, supplicants can send an EAPOL-Logoff message to
If the requirement is to determine when the user disconnects, isn't this best handled by accounting data? That is, if the authenticator supports sending Accounting-Request packets to RADIUS, then when the user disconnects, it should send an Acct-Status-Type=stop request.
On Fri, Apr 9, 2010 at 12:11 PM, Garber, Neal <Neal.Garber@energyeast.com> wrote:
From what I've read, supplicants can send an EAPOL-Logoff message to
If the requirement is to determine when the user disconnects, isn't this best handled by accounting data? That is, if the authenticator supports sending Accounting-Request packets to RADIUS, then when the user disconnects, it should send an Acct-Status-Type=stop request.
Absolutely. While I've not played with 802.1X + accounting personally, it looks like there is decent support in Cisco kit: http://www-europe.cisco.com/en/US/docs/ios/sec_user_services/configuration/g... -M
Rosario Lumia wrote:
Sorry for my (very) bad english. Only for clearness: I'd want to know if there is a way to log the end of a 802.1x session. I mean: a client turn off his wireless card and (I think) AP can (??) send a message to freeradius because the association between client and AP is lost.
Does the AP send an accounting message saying that the connection was lost?
My question was: is it possible? Your answer was very clear.
Yes... use an AP that sends accounting messages. This isn't a FreeRADIUS problem. Alan DeKok.
participants (4)
-
Alan DeKok -
Garber, Neal -
Matt Hite -
Rosario Lumia