Hi there, I'm trying to setup a freeRadius on MacOSX host 10.6. This OS use FreeRADIUS Version 2.1.3. I'm looking for informations about how to permit a client device to ask an IP address when it is plugged on the network. The switch forward the request to radius server. The radius server ask to opendirectory (ldap) if the client is allowed (Mac Address check) and in which vlan. Then if the client is allowed the port of the switch is configured in the vlan specified by opendirectory. All informations are welcome. -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group
Fabien COMBERNOUS wrote:
Hi there,
I'm trying to setup a freeRadius on MacOSX host 10.6. This OS use FreeRADIUS Version 2.1.3.
I'm looking for informations about how to permit a client device to ask an IP address when it is plugged on the network.
Is this for PPP? (a) Yes: use the ippool / sqlippool module. (b) No: use DHCP. Alan DeKok.
Alan DeKok wrote:
Fabien COMBERNOUS wrote:
Hi there,
I'm trying to setup a freeRadius on MacOSX host 10.6. This OS use FreeRADIUS Version 2.1.3.
I'm looking for informations about how to permit a client device to ask an IP address when it is plugged on the network.
Is this for PPP?
(a) Yes: use the ippool / sqlippool module.
(b) No: use DHCP.
It is not for ppp. I'm already using dhcp. In a first step, i would like to dynamically assign a vlan to the port of my switch in function of the mac address where the device is plugged. I would like to add a device in the opendirectory, and specifying its mac address and the vlan this mac address have to use. Then when a device is plugged on a port of my switch, it asks to freeradius if this device is allowed. Then the radius ask to opendirectory, the directory answer by no or yes. If yes it also give the vlan number to assign. Now my switch is able to talk with my freeradius server. -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group
On Wed, Feb 24, 2010 at 3:55 PM, Fabien COMBERNOUS <fcombernous@kezia.com> wrote:
It is not for ppp. I'm already using dhcp.
In a first step, i would like to dynamically assign a vlan to the port of my switch in function of the mac address where the device is plugged. I would like to add a device in the opendirectory, and specifying its mac address and the vlan this mac address have to use. Then when a device is plugged on a port of my switch, it asks to freeradius if this device is allowed. Then the radius ask to opendirectory, the directory answer by no or yes. If yes it also give the vlan number to assign.
Now my switch is able to talk with my freeradius server.
Sounds like 802.1x. See http://vuksan.com/linux/dot1x/802-1x-LDAP.html. If your switch sends client MAC (possibly in calling-station-id attribute) then you should be able to create rules based on that. You'll need to setup your clients to use 802.1x as well. You can't expect it to "just work" for any client. By only setting radius and switch. -- Fajar
Fabien COMBERNOUS wrote:
In a first step, i would like to dynamically assign a vlan to the port of my switch in function of the mac address where the device is plugged. I would like to add a device in the opendirectory, and specifying its mac address and the vlan this mac address have to use. Then when a device is plugged on a port of my switch, it asks to freeradius if this device is allowed. Then the radius ask to opendirectory, the directory answer by no or yes. If yes it also give the vlan number to assign.
So... OpenDirectory is an LDAP server. Query the LDAP server for the data. See also raddb/ldap.attrmap Alan DeKok.
participants (3)
-
Alan DeKok -
Fabien COMBERNOUS -
Fajar A. Nugraha