Self Service Kiosk / Workflow to trust untrusted devices to add them to personal VLAN dynamically
Hello FreeRADIUS user, I hope that someone out there is able to give me some piece of advice to my unusual idea. There are two WiFis in our multi-apartment building: 1. WPA2 EAP Auth - for trusted user (such as residents) using FreeRADIUS for authentication and dynamic VLAN assignment 2. WPA2 PSK (for guests, IoT without EAP support etc.) Currently, the admin has to assign printer, TV-Boxes etc. manually to the respective VLAN of a resident. The standard use case to make this necessary is to allow the respective resident to control the device by smartphone. Is it somehow possible to allow each resident to open an GUI and select untrusted devices (devices connected to the WPA2 PSK) and just click on a button to make them trusted, so their VLAN assignment will be change, means FreeRADIUS changes the following Mikrotik-Wireless-VLANID := 10, Mikrotik-Wireless-VLANID-Type := 0, due to this *workflow *triggered by an trusted user via the GUI? Thank you and a restful start into 2022 Stefan
On 01/01/2022 14:52, Stefan Mueller wrote:
Is it somehow possible to allow each resident to open an GUI and select untrusted devices (devices connected to the WPA2 PSK) and just click on a button to make them trusted, so their VLAN assignment will be change, means FreeRADIUS changes the following Mikrotik-Wireless-VLANID := 10, Mikrotik-Wireless-VLANID-Type := 0, due to this *workflow *triggered by an trusted user via the GUI?
Make sure your equipment can support different VLANs on the WPA2-PSK network somehow (that's definitely not a given) Create a database Write a GUI to update the database Possibly have something to collect information about the printers / devices etc on the network and add them to the database (or do this in the GUI) Configure FreeRADIUS upon authentication to read the database and set the correct attributes in the reply. The last bit is the easy bit. You'll have to write the rest yourself. Depending on the wireless equipment you'll possibly be better to add another SSID for the printers and then use the database to restrict access based on MAC address. There's may not be much more you can do as most things won't support different VLANs on WPA2-PSK. -- Matthew
Hi Matthew, Thx for replying that quickly 😀, so you say it is technically feasible? I do ask as you highlight *There's may not be much more you can do as* *most things won't support different VLANs on WPA2-PSK.* There is very detailed tutorial how to realise dynamic VLAN assignment using MikroTik equipment and FreeRADIUS, see https://administrator.de/tutorial/dynamische-vlan-zuweisung-fuer-wlan-u-lan-... (is in German). If that the only concern, that is not showstopper. GUI could be done using home automation system what can speak to FreeRADIUS using its APIs if all can be done through APIs? sent from a fair mobile On Sat, 1 Jan 2022, 16:22 Matthew Newton, <mcn@freeradius.org> wrote:
On 01/01/2022 14:52, Stefan Mueller wrote:
Is it somehow possible to allow each resident to open an GUI and select untrusted devices (devices connected to the WPA2 PSK) and just click on a button to make them trusted, so their VLAN assignment will be change, means FreeRADIUS changes the following Mikrotik-Wireless-VLANID := 10, Mikrotik-Wireless-VLANID-Type := 0, due to this *workflow *triggered by an trusted user via the GUI?
Make sure your equipment can support different VLANs on the WPA2-PSK network somehow (that's definitely not a given)
Create a database
Write a GUI to update the database
Possibly have something to collect information about the printers / devices etc on the network and add them to the database (or do this in the GUI)
Configure FreeRADIUS upon authentication to read the database and set the correct attributes in the reply.
The last bit is the easy bit. You'll have to write the rest yourself.
Depending on the wireless equipment you'll possibly be better to add another SSID for the printers and then use the database to restrict access based on MAC address. There's may not be much more you can do as most things won't support different VLANs on WPA2-PSK.
-- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 01/01/2022 15:59, Stefan Mueller wrote:
Thx for replying that quickly 😀, so you say it is technically feasible?
As I said, it may be. Depends on whether the AP can do VLAN allocation together with WAP2-PSK. It normally only works with WPA2-Enterprise.
I do ask as you highlight *There's may not be much more you can do as* *most things won't support different VLANs on WPA2-PSK.*
It's expected that VLAN allocation will work with WPA2-Enterprise when a RADIUS server is involved. RADIUS isn't normally part of the WPA2-PSK authentication process, so VLAN allocation isn't either. It depends on what the AP does. It's technically possible (if you are happy to base "authentication" on the device MAC address only), but definitely not "normal".
GUI could be done using home automation system what can speak to FreeRADIUS using its APIs if all can be done through APIs?
FreeRADIUS doesn't have APIs - you write data into databases using some external method. FreeRADIUS reads data from databases and uses that to make the policy decisions. -- Matthew
FreeRADIUS doesn't have APIs - you write data into databases using some external method. FreeRADIUS reads data from databases and uses that to make the policy decisions.
so it would basically only database (or files) manipulation As I said, it may be. Depends on whether the AP can do VLAN allocationot
together with WAP2-PSK. It normally only works with WPA2-Enterprise.
it does but would not do a RADIUS query. I meant WPA2-EAP-PSK, my fault, I'm sorry for the confusion by the way, why do you not integrate/leverage fgsants/REST-API-FreeRADIUS: A simple REST Server for the FreeRADIUS rlm_rest module (github.com) <https://github.com/fgsants/REST-API-FreeRADIUS> to allow integration/automation "out of the box"? Le mar. 4 janv. 2022 à 13:36, Matthew Newton <mcn@freeradius.org> a écrit :
On 01/01/2022 15:59, Stefan Mueller wrote:
Thx for replying that quickly 😀, so you say it is technically feasible?
As I said, it may be. Depends on whether the AP can do VLAN allocation together with WAP2-PSK. It normally only works with WPA2-Enterprise.
I do ask as you highlight *There's may not be much more you can do as* *most things won't support different VLANs on WPA2-PSK.*
It's expected that VLAN allocation will work with WPA2-Enterprise when a RADIUS server is involved.
RADIUS isn't normally part of the WPA2-PSK authentication process, so VLAN allocation isn't either. It depends on what the AP does. It's technically possible (if you are happy to base "authentication" on the device MAC address only), but definitely not "normal".
GUI could be done using home automation system what can speak to FreeRADIUS using its APIs if all can be done through APIs?
FreeRADIUS doesn't have APIs - you write data into databases using some external method. FreeRADIUS reads data from databases and uses that to make the policy decisions.
-- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Matthew Newton -
Stefan Mueller