DHCP Scope not getting used after authentication
Dear All, This is my first email to the group so please excuse if I have not followed any rules. Auth and IP Set up: Student devices > Freeradius server > Firewall > ---à eduroam Homeserver Ø Windows DHCP server Ø Unifi WAP portal Network : Student devices connect to Unifi WAP > 2 tagged VLAN Aruba/HP switches > Windows DHCP server has 2 separate subnets Issue: We have set up 2 Vlans to segment the buildings and assign static vlans on the switch ports that connects to the Unifi AP. Depending on the VLAN X or VLAN Y, the DHCP server should provide ipaddress from one of the subnet. Since the windows server upgrade on April 2020, the end devices are picking only X subnet ipaddress. Y subnet is not issued. I have tested with a test vm, can confirm that the Y subnet is issued. I have also used the old windows DHCP server ip address but no changes. Does Free Radius setup has any role in this problem? Regards, Jerome
On Nov 26, 2020, at 4:43 PM, Jerome <jc935@cam.ac.uk> wrote:
We have set up 2 Vlans to segment the buildings and assign static vlans on the switch ports that connects to the Unifi AP. Depending on the VLAN X or VLAN Y, the DHCP server should provide ipaddress from one of the subnet.
Since the windows server upgrade on April 2020, the end devices are picking only X subnet ipaddress. Y subnet is not issued. I have tested with a test vm, can confirm that the Y subnet is issued. I have also used the old windows DHCP server ip address but no changes.
Does Free Radius setup has any role in this problem?
Maybe. If the users are placed in the wrong subnet, then the DHCP server will just assign addresses from that subnet. You'll have to do some network tracing to see what's going on. Look at the FR debug output, packet traces on the different VLANs, etc. Alan DeKok.
Hi Alan, Thank you for your email. The users used to get a vlan tagged with their DHC request I guess. That was how I think the old dhcp server was able to issue ipaddress on X and Y scopes. I see no traces of 2 VLANS mentions on any of the Free radius config files. This set up was working fine before the windows server upgrade. Is there a definite way to check if there are any VLANS assigned for the Authenticated users? I have access to the Radius server but do not have access to Homeserver. I hope the above makes sense. Regards, Jerome -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+jc935=cam.ac.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 26 November 2020 23:34 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: DHCP Scope not getting used after authentication On Nov 26, 2020, at 4:43 PM, Jerome <jc935@cam.ac.uk> wrote:
We have set up 2 Vlans to segment the buildings and assign static vlans on the switch ports that connects to the Unifi AP. Depending on the VLAN X or VLAN Y, the DHCP server should provide ipaddress from one of the subnet.
Since the windows server upgrade on April 2020, the end devices are picking only X subnet ipaddress. Y subnet is not issued. I have tested with a test vm, can confirm that the Y subnet is issued. I have also used the old windows DHCP server ip address but no changes.
Does Free Radius setup has any role in this problem?
Maybe. If the users are placed in the wrong subnet, then the DHCP server will just assign addresses from that subnet. You'll have to do some network tracing to see what's going on. Look at the FR debug output, packet traces on the different VLANs, etc. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Nov 29, 2020, at 10:25 PM, Jerome <jc935@cam.ac.uk> wrote:
Hi Alan,
Thank you for your email. The users used to get a vlan tagged with their DHC request I guess.
DHCP doesn't do VLAN tagging. DHCP doesn't *know* about VLANs. I'm saying that if the user is in the wrong VLAN, then they're in the wrong subnet, and the DHCP server assigns them addresses from that subnet.
That was how I think the old dhcp server was able to issue ipaddress on X and Y scopes. I see no traces of 2 VLANS mentions on any of the Free radius config files. This set up was working fine before the windows server upgrade. Is there a definite way to check if there are any VLANS assigned for the Authenticated users? I have access to the Radius server but do not have access to Homeserver. I hope the above makes sense.
Look a the RADIUS packets using wireshark. Alan DeKok.
participants (2)
-
Alan DeKok -
Jerome