PacketFence + HP Switches + code hacking
Hello All, So I am investigating a network upgrade + better NAC and I wanted to get some thoughts on the deployment. I am currently evaluating it in our lab and saw that PacketFence was pretty easy to set up. Currently have PF 4.1.0 integrated with a Samba4 AD server (No Windows :) ), so that part is done. Looking to get some thoughts on HP switches, looking at evaluating them with PacketFence. Since it doesn't look like they sell the ProCurve switches anymore I'll probably end up getting one (or multiple) of the following depending on how the lab evaluation goes: - HP 2530 - HP 2920 - HP 5120 So even though these are not explicitly listed on the supported list, is there a general consensus how much hacking is required to get support added, or is that is even possible? I'll probably end up sending a diff out so others can take advantage of my work. I'm planning on using 802.1X PEAP (wired), MAC based auth (either .1x or snmp traps), and SNMP so I can throw idiots on my network back into an isolation VLAN. I'm willing to looking into other vendors if someone how someone has suggestions; only reason I'm looking at HP is the price point is nice for the features provided. Thanks in advance! -- Thank You, Nick Van Duyn
hah, obviously the wrong list... mistake here people. -- Thank You, Nick Van Duyn nick.vanduyn@gmail.com
Looking to get some thoughts on HP switches, looking at evaluating them with PacketFence. Since it doesn't look like they sell the ProCurve switches anymore I'll probably end up getting one (or multiple) of the following depending on how the lab evaluation goes: - HP 2530 - HP 2920 - HP 5120
The ProCurve switches got rebranded to HP networking, they still sell the switches, as well as those from 3Com. The 2530 and 2920 will be the next generation of ProCurve switches, whereas I think that 5120 will probably be a 3Com. The ProCurve and 3Com interfaces and feature sets are still very much separate, I don't recommend mixing them. Either go all 3Com or all ProCurve. It's quite easy to tell which is which just by the chassis.
So even though these are not explicitly listed on the supported list, is there a general consensus how much hacking is required to get support added, or is that is even possible? I'll probably end up sending a diff out so others can take advantage of my work.
I'm planning on using 802.1X PEAP (wired), MAC based auth (either .1x or snmp traps), and SNMP so I can throw idiots on my network back into an isolation VLAN. I'm willing to looking into other vendors if someone how someone has suggestions; only reason I'm looking at HP is the price point is nice for the features provided.
The 2920 should support CoA so you don't need SNMP (unless packetfence is the limitation there), it may even support Mac Based VLANs, which allows you to run multiple untagged VLANs on the same port. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
One word of caution if you are planning on supporting VOIP phones with ability to connect a client to the network port on a phone. I tried using RFC 4675 to specify a tagged vlan for the phone and mac/dot1x auth for the "other" device on a 2620. It works ..... for about 2 weeks and then the switch locks up reboot .... and it then works for another 2 weeks. Better than a 2610 which then reboots! Manually configuring the switch to support lldp-med works though. Apparently the 2600 series doesn't support RFC4675 .... took while to find that out :-(( Rgds A On 17 Apr 2014, at 14:04, Arran Cudbard-Bell wrote:
Looking to get some thoughts on HP switches, looking at evaluating them with PacketFence. Since it doesn't look like they sell the ProCurve switches anymore I'll probably end up getting one (or multiple) of the following depending on how the lab evaluation goes: - HP 2530 - HP 2920 - HP 5120
The ProCurve switches got rebranded to HP networking, they still sell the switches, as well as those from 3Com.
The 2530 and 2920 will be the next generation of ProCurve switches, whereas I think that 5120 will probably be a 3Com.
The ProCurve and 3Com interfaces and feature sets are still very much separate, I don't recommend mixing them. Either go all 3Com or all ProCurve. It's quite easy to tell which is which just by the chassis.
So even though these are not explicitly listed on the supported list, is there a general consensus how much hacking is required to get support added, or is that is even possible? I'll probably end up sending a diff out so others can take advantage of my work.
I'm planning on using 802.1X PEAP (wired), MAC based auth (either .1x or snmp traps), and SNMP so I can throw idiots on my network back into an isolation VLAN. I'm willing to looking into other vendors if someone how someone has suggestions; only reason I'm looking at HP is the price point is nice for the features provided.
The 2920 should support CoA so you don't need SNMP (unless packetfence is the limitation there), it may even support Mac Based VLANs, which allows you to run multiple untagged VLANs on the same port.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 17 Apr 2014, at 09:12, Alex Sharaz <alex.sharaz@york.ac.uk> wrote:
One word of caution if you are planning on supporting VOIP phones with ability to connect a client to the network port on a phone. I tried using RFC 4675 to specify a tagged vlan for the phone and mac/dot1x auth for the "other" device on a 2620. It works ..... for about 2 weeks and then the switch locks up reboot .... and it then works for another 2 weeks. Better than a 2610 which then reboots! Manually configuring the switch to support lldp-med works though.
Apparently the 2600 series doesn't support RFC4675 .... took while to find that out :-((
I'm pretty sure they do support tagged VLANs, you should log a bug report with HP, they are generally responsive. They should send you a debug build with the ASSERTS turned on, which should help track the problem down. Ask for Tonny Mulder, or Marinus Rosenbrand when you get through to EMEA support. If they're uncooperative contact me off list and and i'll help you get it fixed. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 17 Apr 2014, at 15:28, Arran Cudbard-Bell wrote:
On 17 Apr 2014, at 09:12, Alex Sharaz <alex.sharaz@york.ac.uk> wrote:
One word of caution if you are planning on supporting VOIP phones with ability to connect a client to the network port on a phone. I tried using RFC 4675 to specify a tagged vlan for the phone and mac/dot1x auth for the "other" device on a 2620. It works ..... for about 2 weeks and then the switch locks up reboot .... and it then works for another 2 weeks. Better than a 2610 which then reboots! Manually configuring the switch to support lldp-med works though.
Apparently the 2600 series doesn't support RFC4675 .... took while to find that out :-((
I'm pretty sure they do support tagged VLANs, you should log a bug report with HP, they are generally responsive.
oops sorry, meant that you can't use the RADIUS attribute to tell the switch which vlan to put the ipphone into. You can define a vlan for voice, define it as a voice vlan and tag ports into it. vlan <number> name voice_vlan voice tagged 1-48 ! Then when you plug a phone into any of ports 1-48 there'll be a tagged link to the phone for the voice vlan. Wot you can't do is Thu Mar 27 15:45:57 2014 : Info: Sending Access-Accept packet to host 10.4.72.5 port 1812, id=41, length=0 Thu Mar 27 15:45:57 2014 : Info: HP-Egress-VLANID = 822084526 Thu Mar 27 15:45:57 2014 : Info: HP-Port-Client-Limit-MA = 4 Thu Mar 27 15:45:57 2014 : Info: HP-Port-Client-Limit-Dot1x = 4 Thu Mar 27 15:45:57 2014 : Info: Acct-Interim-Interval = 1800 Thu Mar 27 15:45:57 2014 : Info: Termination-Action = RADIUS-Request Thu Mar 27 15:45:57 2014 : Info: Session-Timeout = 28800 everything appears to work ... for about 2 weeks then the switch locks up. On the 2610 worse,plug the phone into a port and the switch reboots. Switch of radius accounting and you have the same functionality as a 2620... for 'bout the same length of time. Spent about a month with 2 fault calls logged until Jason Luckett said that RFC 4... isn;t supported on 2600 series switches. Rgds A
They should send you a debug build with the ASSERTS turned on, which should help track the problem down.
Ask for Tonny Mulder, or Marinus Rosenbrand when you get through to EMEA support. If they're uncooperative contact me off list and and i'll help you get it fixed.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alex Sharaz -
Arran Cudbard-Bell -
Nick Van Duyn