Upgrade or migration away from VMPS - what are my options?
Hi, since I've been having issues with the latest Cisco OS (version 15) and VMPS not connecting properly what are my alternatives? Sure I can stay on version 12.x if need be however, if we purchase some new kit that **only** comes with version 15 I will have the same issue as previously had with IP phones not registering etc.... I have been Google'ing a bit to attempt try to understand the difference as I was told that VMPS was a subset of FreeRADIUS; the only thing is that I'm quite new to this and just need some advice and/or to be pointed in the right direction as of to what material to start reading - additionally what I should be looking for. So really to summarize, since VMPS is old and I have been told to move away from it which system should I be looking at to automate vlan distribution throughout the network and is there any chance of using the already built MySQL VMPS database?? Regards, Kaya
On 06/18/2012 08:10 AM, Kaya Saman wrote:
Hi,
since I've been having issues with the latest Cisco OS (version 15) and VMPS not connecting properly what are my alternatives?
The equivalent, RADIUS-based Cisco feature is called "MAB". It more or less does exactly the same thing as VMPS, but with a RADIUS packet instead. You just need to configure MAB on the IOS ports (it's a bit more typing, unfortunately) and configure FreeRADIUS for MAC auth, which is well documented in the wiki. A more involved alternative is 802.1x which, unlike MAC-based auth, involves credentials, and is therefore more secure as it's harder to fool.
On Mon, Jun 18, 2012 at 8:19 AM, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 06/18/2012 08:10 AM, Kaya Saman wrote:
Hi,
since I've been having issues with the latest Cisco OS (version 15) and VMPS not connecting properly what are my alternatives?
The equivalent, RADIUS-based Cisco feature is called "MAB". It more or less does exactly the same thing as VMPS, but with a RADIUS packet instead.
You just need to configure MAB on the IOS ports (it's a bit more typing, unfortunately) and configure FreeRADIUS for MAC auth, which is well documented in the wiki.
A more involved alternative is 802.1x which, unlike MAC-based auth, involves credentials, and is therefore more secure as it's harder to fool. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks for the response! I have checked out: http://www.booches.nl/2008/06/mac-authentication-bypass-continued/ http://wiki.freeradius.org/Mac-Auth To get a bit of an idea of what awaits and how things fit together..... Basically it seems that I need to be running 802.1x as MAB according to the articles is: Mac-based authentication which needs 802.1x to function?? Or did I misunderstand? Regards, Kaya
On 18/06/12 08:52, Kaya Saman wrote:
Basically it seems that I need to be running 802.1x as MAB according to the articles is: Mac-based authentication which needs 802.1x to function??
Or did I misunderstand?
This is IOS-version dependent. In some versions of IOS, MAB is only available as a "fallback" for 802.1x. In later versions of IOS, they added MAB as an independent configuration; you don't need to configure 802.1x, just MAB.
Hi, I am newbie to freeradius. I am using freeradius 2.1.10 + Mysql + Coovachilli 1.2.6 + Daloradius. I tested with client successfully, every thing working fine. Now I don't know the process how to limit the user data either volume or time based. Please some one help me in this regards. Thanks & Best Regards, MallaReddy Sama,
On Mon, Jun 18, 2012 at 2:38 PM, Malla reddy Sama <mallareddy.sama@yahoo.com> wrote:
Hi,
I am newbie to freeradius.
I am using freeradius 2.1.10 + Mysql + Coovachilli 1.2.6 + Daloradius.
I tested with client successfully, every thing working fine.
Now I don't know the process how to limit the user data either volume or time based.
If you already store accounting data in sql, see http://wiki.freeradius.org/Rlm_sqlcounter By default it limits by time, but chillispot-based AP should be able to limit by volume as well, so you should be able to modify rlm_sqlcounter accordingly by changing the attributes. -- Fajar
Hi, I followed wiki rlm_sqlcounter to make the time base limit. I set counter as 300 Sec for the User and after 300 sec the user not disconnected. When I logout and try to login again it showing your day limit completed. Please can anyone explain why user not logout after counter reach 300 sec and help me how to fix the user logout after counter reach zero. Thanks & Best Regards, MallaReddy Sama, ________________________________ From: Fajar A. Nugraha <list@fajar.net> To: Malla reddy Sama <mallareddy.sama@yahoo.com>; FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Sent: Monday, 18 June 2012 9:43 AM Subject: Re: Reg: Volume or time base limit. On Mon, Jun 18, 2012 at 2:38 PM, Malla reddy Sama <mallareddy.sama@yahoo.com> wrote:
Hi,
I am newbie to freeradius.
I am using freeradius 2.1.10 + Mysql + Coovachilli 1.2.6 + Daloradius.
I tested with client successfully, every thing working fine.
Now I don't know the process how to limit the user data either volume or time based.
If you already store accounting data in sql, see http://wiki.freeradius.org/Rlm_sqlcounter By default it limits by time, but chillispot-based AP should be able to limit by volume as well, so you should be able to modify rlm_sqlcounter accordingly by changing the attributes. -- Fajar
On Tue, Jun 19, 2012 at 9:42 PM, Malla reddy Sama <mallareddy.sama@yahoo.com> wrote:
Hi,
I followed wiki rlm_sqlcounter to make the time base limit.
I set counter as 300 Sec for the User and after 300 sec the user not disconnected.
When I logout and try to login again it showing your day limit completed.
Please can anyone explain why user not logout after counter reach 300 sec and help me how to fix the user logout after counter reach zero.
Did you READ my reply? Did you DO something about sqlcca3? Did you TRY again in debug mode after you fixed it? Did you READ the debug log again after you fixed it? Simply saying "I did xxx and it's not working" is useless. -- Fajar
Dear Fajar, Sorry to not inform you that I read your reply and I changed sqlcc3 to sql. So the error sqlcc3 is sloved by changing. One error still i am getting : rlm_sqlcounter: Could not find Check item value pair I am not solving this error. Please can you help on this. I attached a copy. In that, the test2 user I gave 300 sec, but after 300 sec the user till getting access. Once I logout and l try to login then it showing your limit over ...? Thanks & Best Regards, MallaReddy Sama, ________________________________ From: Fajar A. Nugraha <list@fajar.net> To: Malla reddy Sama <mallareddy.sama@yahoo.com> Cc: "freeradius-users@lists.freeradius.org" <freeradius-users@lists.freeradius.org> Sent: Tuesday, 19 June 2012 11:36 PM Subject: Re: Reg: Volume or time base limit. On Tue, Jun 19, 2012 at 9:42 PM, Malla reddy Sama <mallareddy.sama@yahoo.com> wrote:
Hi,
I followed wiki rlm_sqlcounter to make the time base limit.
I set counter as 300 Sec for the User and after 300 sec the user not disconnected.
When I logout and try to login again it showing your day limit completed.
Please can anyone explain why user not logout after counter reach 300 sec and help me how to fix the user logout after counter reach zero.
Did you READ my reply? Did you DO something about sqlcca3? Did you TRY again in debug mode after you fixed it? Did you READ the debug log again after you fixed it? Simply saying "I did xxx and it's not working" is useless. -- Fajar
On Wed, Jun 20, 2012 at 2:59 PM, Malla reddy Sama <mallareddy.sama@yahoo.com> wrote:
Dear Fajar,
Sorry to not inform you that I read your reply and I changed sqlcc3 to sql. So the error sqlcc3 is sloved by changing.
One error still i am getting :
rlm_sqlcounter: Could not find Check item value pair
Hint: did you read the wiki? What did you put as "check-name" on your sqlcounter instance?
I am not solving this error. Please can you help on this.
Nobody can. You deleted all lines of debug output where the server is starting up. That effectively means nobody will know how you configure your server. Good luck solving your problems on your own. -- Fajar
Dear All, I am using freeradius 2.1.10 and Mysql. The server working on interface eth0. Any request get to this interface, the request has to be accept without checking the database. Any suggestion on this regards. Thanks & Best Regards, MallaReddy,
On Fri, Jun 22, 2012 at 5:27 PM, Malla reddy Sama <mallareddy.sama@yahoo.com> wrote:
Dear All,
I am using freeradius 2.1.10 and Mysql.
The server working on interface eth0. Any request get to this interface, the request has to be accept without checking the database.
Any suggestion on this regards.
As usual, did you read the wiki? http://wiki.freeradius.org/FAQ#How-do-I-permit-access-to-any-user-regardless... ... and if doesn't work for you, search for "It still doesn't work!" on that same page. -- Fajar
Dear Fajar, Thank you very for the help. I have some doubts can you clarify please .... :) In the Clients.conf I assign the clients as below: client 193.168.1.0/24 { //ip of server secret=secret } 1. It is possible with above IP and Password the clients get the authentication accept with radius server ..? what this IP and Password make (server allocate IP address for the client on the above range)..? 2. If I not keep this IP and Password in Clients.conf and just assign "DEFAULT Auth-Type := Accept" in user file. Then every user on eth0 interface get authentication accept, is correct ..? Please can you clarify me. Thanks & Best Regards, MallaReddy Sama, ________________________________ From: Fajar A. Nugraha <list@fajar.net> To: Malla reddy Sama <mallareddy.sama@yahoo.com>; FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Sent: Friday, 22 June 2012 12:35 PM Subject: Re: Reg: Accept the user without Mysql check. On Fri, Jun 22, 2012 at 5:27 PM, Malla reddy Sama <mallareddy.sama@yahoo.com> wrote:
Dear All,
I am using freeradius 2.1.10 and Mysql.
The server working on interface eth0. Any request get to this interface, the request has to be accept without checking the database.
Any suggestion on this regards.
As usual, did you read the wiki? http://wiki.freeradius.org/FAQ#How-do-I-permit-access-to-any-user-regardless... ... and if doesn't work for you, search for "It still doesn't work!" on that same page. -- Fajar
On Fri, Jun 22, 2012 at 5:59 PM, Malla reddy Sama <mallareddy.sama@yahoo.com> wrote:
Dear Fajar,
Thank you very for the help.
I have some doubts can you clarify please .... :)
In the Clients.conf I assign the clients as below:
client 193.168.1.0/24 { //ip of server secret=secret }
1. It is possible with above IP and Password the clients get the authentication accept with radius server ..? what this IP and Password make (server allocate IP address for the client on the above range)..?
I suggest you stop right there. Read more documentation (including the wiki), and do some experiments first to understand the basic concepts. Hint: "client" there is not "user PC connected to the access point". Rather, it's THE access point (a.k.a. NAS) Now your question can mean several different things: (1) how can I make users connected to that NAS get accepted regardles of password. The answer, read documentation for "unlang", and set auth-type for a special condition (e.g. NAS-IP-address) (2) how can I make users get accepted regardles of password ONLY IF the users was already assigned IP address x.x.x.x by the NAS (e.g. chillispot) The answer, I don't think you can. And even if you could, I wouldn't recommend it. But if you insist anyway, check out what attributes the NAS sends, and set attributes as needed with unlang. If the NAS sends users's IP address as part of request attribute, then it can be done. If the NAS doesn't send it, then it can't be done. (3) how can I make users get accepted regardles of password, and have radius assign dynamic IP in the range of x.x.x.x Probably use something like rlm_sqlippool in addition to setting Auth-Type. Which one do you want? If you didn't understand what I wrote on those three points, then again, spend some time to read more documentation (including the wiki), and do some experiments first to understand the basic concepts -- Fajar
participants (4)
-
Fajar A. Nugraha -
Kaya Saman -
Malla reddy Sama -
Phil Mayers