Rainer Brinkmann wrote:

Hello,

we wonder, how a freeradius can request a client to use a fixed EAP-Method: so its defined: Client starts with EAP-Start-Msg Radius wants EAP-Identity Client answers with Username or Hostname NOT using a special EAP-Method

Radius now starts communiucating with the first EAP-Packet, using the special EAP-Method

For this, it will use the default_eap_type

Question:

you run in your wireless LAN many SSIDs: SSID1 shall use EAP-TTLS SSID2 shall use EAP-TLS (high-secured Net like personal Data)

what logic starts the right inner-EAP-Protocol, cause neither the AccessPoint(WLAN-Controller), nor the radius server know, what Method to use, when there are many enabled.

e.g. on a cisco-Radius, that runs with enabled PEAP and TLS, but there's no special attribute defined to control that

Yes there is. Set "EAP-Type" (see dictionary.freeradius.internal) e.g. DEFAULT Your-SSID-AVP = "SSID1", EAP-Type := EAP-TTLS DEFAULT Your-SSID-AVP = "SSID2", EAP-Type := EAP-TLS Note however, the client can still NAK the radius server and request a different type, and the radius server will allow that. To prevent that, you'd need to run >1 instance of the eap module and disable the other eap types. The following is untested and may not work for various reasons, but is worth a try: modules { eap eap_ttlsonly { default_eap_type = ttls # only define one eap sub-module ttls { # stuff } } eap eap_tlsonly { default_eap_type = tls # only define one eap sub-module tls { # stuff } } } authorize { preprocess users Autz-Type TTLS-only { eap_ttlsonly } Autz-Type TLS-only { eap_tlsonly } } authenticate { Auth-Type TTLS-only { eap_ttlsonly } Auth-Type TLS-only { eap_tlsonly } } ...the in "users": DEFAULT SSID = "ssid1", Autz-Type := TTLS-only, Auth-Type := TTLS-only DEFAULT SSID = "ssid2", Autz-Type := TLS-only, Auth-Type := TLS-only

thanks for reply, Rainer Brinkmann

University-Clinicum Hamburg / Germany

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html