Hi, I'm checking the possibility to migrate from our cisco ACS 4.2 to freeradius for our radius server wich is use for our wireless (cisco WLC) and VPN (Cisco ASA). I want to know if it's possible to do NAR (network access restriction) in freeradius like in ACS; Example: I am able to permit only certain user based on their active directory group to connect to my certain wireless SSID. Also I use ACS to configure Downloadable IP ACLs for the VPN access Does freeradius have similar option? Thank you, Yannick Menard ---------------------------------------------------------------------------------------------------------- Ce courriel a �t� filtr� par ModusGate et Webshield afin de le certifier comme l�gitime et exempt de virus.
I want to know if it’s possible to do NAR (network access restriction) in freeradius like in ACS;
Example: I am able to permit only certain user based on their active directory group to connect to my certain wireless SSID.
Yes. You can use LDAP-Groups and the users file to do the mappings. It's relatively simple once you've configured the LDAP module.
Also I use ACS to configure Downloadable IP ACLs for the VPN access
Does freeradius have similar option?
It's just RADIUS, if you know the attribute definitions then you can make it work. -Arran
Menard, Yannick writes:
Example: I am able to permit only certain user based on their active directory group to connect to my certain wireless SSID.
Also I use ACS to configure Downloadable IP ACLs for the VPN access
Does freeradius have similar option?
Yes and yes, but it will be more programmatic than you are used to with ACS. Meaning, FreeRADIUS can do just about anything that's actually possible, but if you utilize this flexibility deeply, the result will end up looking like a script, rather than a config file. Which is really a result of business logic being more naturally expressed as procedural code than as a collection of settings. Whether it's a good fit for your organization depends on the people who will have to administer it. There are many modules that make common tasks use config files and even store some business logic on the database side. Whether these modules will fit all your particular needs depends on how peculiar your needs are.
participants (3)
-
Arran Cudbard-Bell -
Brian Julin -
Menard, Yannick