Heya, i'm a bit stuck. My xp box should auth with ssl cert - works ok so far. But how to assign vlan? When doing this with user, i put my user + pass into users file - works. But for ssl cert? I want my xp box authentificated by ssl cert and after that, my user should logon to "his" vlan. So that i have a "protected" vlan for "my" boxes (to avoid giving access to my auth server to foreign notebooks) and after that, if someone of my users log in, he will be transfered to his vlan... hope you understand... Thanksalot!
if I understand you correctly you wanna do this enable EAP on your Cisco switch; where all ports are in shutdown mode. a user on your XP box has a User Cert which is passed through EAP to your Freeradius box; the freeradius authenticates the user with his certificate "DN" etc. then instructes the switch to "no shut" the port and assign that port to a predefined VLAN you allocated for that user or other guest users in your database. i.e. if [ "cn=bla,ou=bla,dc=id10t,dc=net" == "match" }; then $vlan = 100; fi let me know if you wanna do this as described above. and how did you get it to work with username and password? On Tue, Mar 25, 2008 at 7:23 AM, mrhotstandby@gmail.com < mrhotstandby@gmail.com> wrote:
Heya,
i'm a bit stuck. My xp box should auth with ssl cert - works ok so far. But how to assign vlan? When doing this with user, i put my user + pass into users file - works. But for ssl cert? I want my xp box authentificated by ssl cert and after that, my user should logon to "his" vlan. So that i have a "protected" vlan for "my" boxes (to avoid giving access to my auth server to foreign notebooks) and after that, if someone of my users log in, he will be transfered to his vlan...
hope you understand...
Thanksalot! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
hi, you wouldnt be able to have the post in shutdown mode - or EAP would never be undertaken. you need to configure the cisco switch so that it does 802.1x authentication (see cisco docs on how to configure the switch for 802.1x and for RADIUS) then you simply configure FreeRADIUS to send back the VLAN attribute - the switch can be configured so that no EAP or unsuccesful EAP gets different VLAN alan
Hi, thanks for replys! i'm very sorry, there is a little missunderstanding :( Switch works ok so far, so nothing needs to be done there. My client is xp box with logon client which can do maschine auth and prompt the user for his name and pass... So i use ssl to auth the maschine (has a general cert like "clientofmycompany"). before that i just used user+pw for the box, which worked and i had user+pw in my users file... to provide vlan id, you know? now i read when using ssl, i don't need the user+pw stuff in my users file - but how assign vlan then? And after all that stuff, if user logs on, a new 802.1x request is send out, which uses ssl + user + pw (ttls) to put him in his "home" vlan. Now better? sorry for the missunderstanding :( Thanksalot!
Hi,
i'm very sorry, there is a little missunderstanding :( Switch works ok so far, so nothing needs to be done there. My client is xp box with logon client which can do maschine auth and prompt the user for his name and pass... So i use ssl to auth the maschine (has a general cert like "clientofmycompany"). before that i just used user+pw for the box, which worked and i had user+pw in my users file... to provide vlan id, you know? now i read when using ssl, i don't need the user+pw stuff in my users file - but how assign vlan then? And after all that stuff, if user logs on, a new 802.1x request is send out, which uses ssl + user + pw (ttls) to put him in his "home" vlan.
ok, so the auth is now via the TLS module - so you will need to use any of the other methods to send back VLAN attributes - users, sql, perl, python etc - any of them will do - you just need to think on what basis you will be assigning the VLAN... eg UserName? IP? NAS? alan
alan, thank, was trying to follow mr hot pants' grammar. On Tue, Mar 25, 2008 at 10:18 AM, <A.L.M.Buxey@lboro.ac.uk> wrote:
hi,
you wouldnt be able to have the post in shutdown mode - or EAP would never be undertaken.
you need to configure the cisco switch so that it does 802.1x authentication (see cisco docs on how to configure the switch for 802.1x and for RADIUS) then you simply configure FreeRADIUS to send back the VLAN attribute - the switch can be configured so that no EAP or unsuccesful EAP gets different VLAN
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Donny Jekels -
mrhotstandby＠gmail.com