Dynamic VLAN assignment works on EAP-MD5, but not EAP-PEAP!!!
Good afternoon, I am very frustrated to get it work. I appreciate any advice! I have a very simple test environment. Laptop (WinXPpro) --------------------------- Cisco3750SW ------------------------------- Radius server (RHEL 4 with FreeRADIUS Version 2.1.6) 172.17.254.100/16 172.17.1.1/16 I have figured out how to configure attributes. Here is my "user" file: test Cleartext-Password := "test" Tunnel-Type = 16777229, Tunnel-Medium-Type = 16777222, Tunnel-Private-Group-ID = 3 When I use MD5-Challenge, I got put in the right vlan I wanted. However if I choose PEAP, I can be authenticated but the vlan thing won't work. I checked the Radius -X output very carefully and I don't see the server is sending any attributes, as it did when the MD5 is used... I chose different types of authentication on the windows box. It seems I don't have to change any configuration on the radius server for both authentications to work. I will attach both radius -X output for both types. I actually don't know if it's proper to ask questions in this email group... If I am asking at a wrong place, please tell me where I should go for asking questions like this... Thank you!! Difan
I have figured out how to configure attributes. Here is my "user" file:
test Cleartext-Password := "test"
Tunnel-Type = 16777229,
Tunnel-Medium-Type = 16777222,
Tunnel-Private-Group-ID = 3
When I use MD5-Challenge, I got put in the right vlan I wanted. However if I choose PEAP, I can be authenticated but the vlan thing won't work. I checked the Radius -X output very carefully and I don't see the server is sending any attributes, as it did when the MD5 is used... I chose different types of authentication on the windows box. It seems I don't have to change any configuration on the radius server for both authentications to work. I will attach both radius -X output for both types.
You have those attributes in the tunneled reply. You should enable use_tunnled_reply in peap section of eap.conf. Ivan Kalik
Hey Ivan, Thank you very much for your help! Now it works beautifully! My next step is to integrate FreeRadius with my Windows domain to use Windows AD for authentication. I am sure I will more questions for you guys! Thank you! Guest-tek, Difan Zhao difan.zhao@guest-tek.com www.guest-tek.com Office: 403-509-1010 ext 3048 Cell: 403-689-7514 -----Original Message----- From: freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradius.org [mailto:freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradi us.org] On Behalf Of tnt@kalik.net Sent: Thursday, December 17, 2009 6:53 PM To: FreeRadius users mailing list Subject: Re: Dynamic VLAN assignment works on EAP-MD5, but not EAP-PEAP!!!
I have figured out how to configure attributes. Here is my "user" file:
test Cleartext-Password := "test"
Tunnel-Type = 16777229,
Tunnel-Medium-Type = 16777222,
Tunnel-Private-Group-ID = 3
When I use MD5-Challenge, I got put in the right vlan I wanted. However if I choose PEAP, I can be authenticated but the vlan thing won't work. I checked the Radius -X output very carefully and I don't see the server is sending any attributes, as it did when the MD5 is used... I chose different types of authentication on the windows box. It seems I don't have to change any configuration on the radius server for both authentications to work. I will attach both radius -X output for both types.
You have those attributes in the tunneled reply. You should enable use_tunnled_reply in peap section of eap.conf. Ivan Kalik - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thank you very much for your help! Now it works beautifully!
My next step is to integrate FreeRadius with my Windows domain to use Windows AD for authentication. I am sure I will more questions for you guys!
http://deployingradius.com/documents/configuration/active_directory.html Ivan Kalik
participants (2)
-
Difan Zhao -
tnt＠kalik.net