determining conditions to differentiate message? types
i was told that the "if (EAP-Message)" condition would not differentiate between MAC auth and normal .1x, and that i need to capture and read the packets a bit more to make that differentiation. where can i go to find more info about how to do that? how do i find what are conditions that i can key off of? i am looking to do radius vlan assignment, and need to work through getting the conditions identified properly and replying correctly. thanks in advance, brendan
On May 30, 2016, at 12:50 PM, Brendan Kearney <bpk678@gmail.com> wrote:
i was told that the "if (EAP-Message)" condition would not differentiate between MAC auth and normal .1x, and that i need to capture and read the packets a bit more to make that differentiation. where can i go to find more info about how to do that? how do i find what are conditions that i can key off of?
Run the server in debug mode, as suggested in the FAQ, "man" page, web pages, and pretty much daily on this list.
i am looking to do radius vlan assignment, and need to work through getting the conditions identified properly and replying correctly.
Read the debug output. It tells you what the server is receiving, and what the server is doing with the packets it's receiving. Alan DeKok.
On 05/30/2016 01:19 PM, Alan DeKok wrote:
On May 30, 2016, at 12:50 PM, Brendan Kearney <bpk678@gmail.com> wrote:
i was told that the "if (EAP-Message)" condition would not differentiate between MAC auth and normal .1x, and that i need to capture and read the packets a bit more to make that differentiation. where can i go to find more info about how to do that? how do i find what are conditions that i can key off of? Run the server in debug mode, as suggested in the FAQ, "man" page, web pages, and pretty much daily on this list.
i am looking to do radius vlan assignment, and need to work through getting the conditions identified properly and replying correctly. Read the debug output. It tells you what the server is receiving, and what the server is doing with the packets it's receiving.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html did both of those already, and still have the same questions... i need to know how to better read the data i have.
On May 30, 2016, at 1:28 PM, Brendan Kearney <bpk678@gmail.com> wrote:
did both of those already, and still have the same questions... i need to know how to better read the data i have.
See "man unlang". It describes how the policies work. See raddb/sites-available/default. It gives many examples of policies. When you read raddb/sites-available/default and run the server in debugging mode, you'll see that the debug output follows the contents of the "default" virtual server. It also prints out which RADIUS attributes it receives, and the values of those attributes. Your job is to read the debug output for the MAC auth and non-MAC auth cases. Compare them. See what is different in the two RADIUS packets. Then, write unlang rules to look for those differences, and give them different policies. This *is* programming. If you're not comfortable with programming, it won't end well. And post summaries of the debug logs to the list. Ask good questions. it helps. Alan DeKok.
participants (2)
-
Alan DeKok -
Brendan Kearney