Dear FR users, I've configured FR2 (2.1.8) to authenticate users from the users file, and I ran into a strange problem. In the first case, I've configured it to direct a user to VLAN 129: user1 Cleartext-Password := "Default1234" Tunnel-type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = "129", Termination-Action = "RADIUS-Request" User authentication works fine, but the user isn't directed to the correct VLAN, the switch port remains at its default VLAN. Debug log: http://pastebin.ca/1880327 In the second case, I've turned off 802.1X on the client, then I've set it's MAC address in the users file (of cource, mab is enabled on my Cisco switch): 000bcd0axxxx Cleartext-Password := "000bcd0axxxx" Tunnel-type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = "129", Termination-Action = "RADIUS-Request" Authentication works, the PC is directed to its VLAN. What did I do wrong? Can you help me solve this issue? Thanks in advance. Regards, Andras
Andras Dosztal wrote:
I've configured FR2 (2.1.8) to authenticate users from the users file, and I ran into a strange problem. In the first case, I've configured it to direct a user to VLAN 129: .. User authentication works fine, but the user isn't directed to the correct VLAN, the switch port remains at its default VLAN. Debug log: http://pastebin.ca/1880327
There is nothing you can do to the RADIUS server to fix this. Find out why the NAS is ignoring the response of the server, and fix the NAS. Alan DeKok.
How could it be, when it passes the same information in both cases (the only difference is the username/password)? Is it possible that the switch interprets the reply differently for dot1x and mab authentication? I know it's rather Cisco related issue than RADIUS, but maybe someone experienced it before. Regards, Andras On Thu, 10 Jun 2010 14:13:40 +0200, Alan DeKok <aland@deployingradius.com> wrote:
There is nothing you can do to the RADIUS server to fix this. Find out why the NAS is ignoring the response of the server, and fix the NAS.
Alan DeKok.
How could it be, when it passes the same information in both cases (the only difference is the username/password)? Is it possible that the switch interprets the reply differently for dot1x and mab authentication? I know it's rather Cisco related issue than RADIUS, but maybe someone experienced it before.
The switch has a list of authentication methods to try for each type of login. For example my config for 802.1x says: aaa authentication dot1x default group radius You'll also need: dot1x mac-auth-bypass configured on the interface itself. There's some info here http://www.symantec.com/connect/articles/snac-8021x-mac-authentication-bypas... It's about IAS unfortunately, but it explains the cisco bits. Plenty more on the Cisco site as well. Good luck, Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.
participants (3)
-
Alan DeKok -
Andras Dosztal -
Leighton Man