Hello Dears, I´m using Freeradius for EAPOL authentication with AD (ntlm). My users file is: more /etc/raddb/users DEFAULT Auth-Type = ntlm_auth Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "200" I Success authentication but the switch not assign vlan 200 to client port as log below: Why the switch taking the VLAN 0? 23:27:44: dot1x-ev:dot1x_vlan_assign_authc_success: Successfully assigned VLAN 0 to interface FastEthernet0/22 23:27:44: dot1x-sm:Posting AUTHC_SUCCESS on Client=1A6F44C 23:27:44: dot1x_auth Fa0/22: during state auth_authc_result, got event 23(authcSuccess) 23:27:44: @@@ dot1x_auth Fa0/22: auth_authc_result -> auth_authz_success 23:27:44: dot1x-sm:Fa0/22:001e.6847.9261:auth_authz_success_enter called 23:27:44: dot1x-ev:dot1x_switch_supplicant_add: Adding 001e.6847.9261 on FastEthernet0/22 in vlan 1, domain is DATA 23:27:44: dot1x-ev:dot1x_switch_addr_add: Added MAC 001e.6847.9261 to vlan 1 on interface FastEthernet0/22 23:27:44: dot1x-ev:dot1x_switch_is_dot1x_forwarding_enabled: Forwarding is disabled on Fa0/22 23:27:44: dot1x-ev:ignored vlan 1 vp is added on interface FastEthernet0/22 23:27:44: dot1x-ev:dot1x_switch_is_dot1x_forwarding_enabled: Forwarding is disabled on Fa0/22 23:27:44: dot1x-ev:dot1x_switch_port_authorized: set dot1x ask handler on interface FastEthernet0/22 23:27:44: dot1x-ev:Received successful Authz complete for 001e.6847.9261 23:27:44: dot1x-sm:Posting AUTHZ_SUCCESS on Client=1A6F44C 23:27:44: dot1x_auth Fa0/22: during state auth_authz_success, got event 26(authzSuccess) 23:27:44: @@@ dot1x_auth Fa0/22: auth_authz_success -> auth_authenticated 23:27:44: dot1x-sm:Fa0/22:001e.6847.9261:auth_authenticated_enter called 23:27:44: dot1x-ev:FastEthernet0/22:Sending EAPOL packet to group PAE address 23:27:44: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/22. 23:27:44: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/22 23:27:45: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to up 23:28:15: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up PS. I tested sending attribute with Cisco ACS and ran Luciano Rangel Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
Rangel, Luciano wrote:
I Success authentication but the switch not assign vlan 200 to client port as log below:
*Why the switch taking the VLAN 0?*
Because the switch is ignoring the VLAN in the Access-Request.
PS. I tested sending attribute with Cisco ACS and ran
There's no magic here. Look at the Access-Request from ACS. It's different than the Access-Request from FreeRADIUS. So... make FreeRADIUS send the same attributes in the Access-Request. It *will* work. Alan DeKok.
Alan, In my switch I see that radius send vlan 0 but as Access-chalange send vlan 200 as below. Sending Access-Challenge of id 155 to 10.0.0.3 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "200" EAP-Message = 0x0103001604108840585485ec8c2c8e14826bdf5ec42b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x42b5c77d42b6c3940045ff626d0da231 I would like to know what is wrong with the syntax of my user file for send vlan 0 instead of vlan 200: User file: DEFAULT Auth-Type = ntlm_auth Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 200 Regards, Luciano Rangel -----Original Message----- From: freeradius-users-bounces+luciano.rangel=logica.com@lists.freeradius.org [mailto:freeradius-users-bounces+luciano.rangel=logica.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: sábado, 4 de dezembro de 2010 08:16 To: FreeRadius users mailing list Subject: Re: Assign VLAN Rangel, Luciano wrote:
I Success authentication but the switch not assign vlan 200 to client port as log below:
*Why the switch taking the VLAN 0?*
Because the switch is ignoring the VLAN in the Access-Request.
PS. I tested sending attribute with Cisco ACS and ran
There's no magic here. Look at the Access-Request from ACS. It's different than the Access-Request from FreeRADIUS. So... make FreeRADIUS send the same attributes in the Access-Request. It *will* work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
Hi,
Sending Access-Challenge of id 155 to 10.0.0.3 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "200" EAP-Message = 0x0103001604108840585485ec8c2c8e14826bdf5ec42b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x42b5c77d42b6c3940045ff626d0da231
I would like to know what is wrong with the syntax of my user file for send vlan 0 instead of vlan 200:
what makes you think its sending vlan 0 ?? alan
Hi Alan, I see my switch log. When I use freeradius my switch show logs below: 23:27:44: dot1x-ev:dot1x_vlan_assign_authc_success: Successfully assigned VLAN 0 to interface FastEthernet0/22 23:27:44: dot1x-sm:Posting AUTHC_SUCCESS on Client=1A6F44C 23:27:44: dot1x_auth Fa0/22: during state auth_authc_result, got event 23(authcSuccess) 23:27:44: @@@ dot1x_auth Fa0/22: auth_authc_result -> auth_authz_success 23:27:44: dot1x-sm:Fa0/22:001e.6847.9261:auth_authz_success_enter called 23:27:44: dot1x-ev:dot1x_switch_supplicant_add: Adding 001e.6847.9261 on FastEthernet0/22 in vlan 1, domain is DATA 23:27:44: dot1x-ev:dot1x_switch_addr_add: Added MAC 001e.6847.9261 to vlan 1 on interface FastEthernet0/22 23:27:44: dot1x-ev:dot1x_switch_is_dot1x_forwarding_enabled: Forwarding is disabled on Fa0/22 23:27:44: dot1x-ev:ignored vlan 1 vp is added on interface FastEthernet0/22 23:27:44: dot1x-ev:dot1x_switch_is_dot1x_forwarding_enabled: Forwarding is disabled on Fa0/22 23:27:44: dot1x-ev:dot1x_switch_port_authorized: set dot1x ask handler on interface FastEthernet0/22 23:27:44: dot1x-ev:Received successful Authz complete for 001e.6847.9261 23:27:44: dot1x-sm:Posting AUTHZ_SUCCESS on Client=1A6F44C 23:27:44: dot1x_auth Fa0/22: during state auth_authz_success, got event 26(authzSuccess) 23:27:44: @@@ dot1x_auth Fa0/22: auth_authz_success -> auth_authenticated 23:27:44: dot1x-sm:Fa0/22:001e.6847.9261:auth_authenticated_enter called 23:27:44: dot1x-ev:FastEthernet0/22:Sending EAPOL packet to group PAE address 23:27:44: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/22. 23:27:44: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/22 23:27:45: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to up 23:28:15: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up When I use ACS my switch show logs below: 4d01h: dot1x-ev:dot1x_vlan_assign_authc_success: Successfully assigned VLAN 200 to interface FastEthernet0/22 4d01h: dot1x-sm:Posting AUTHC_SUCCESS on Client=1A6F44C 4d01h: dot1x_auth Fa0/22: during state auth_authc_result, got event 23(authcSuccess) 4d01h: @@@ dot1x_auth Fa0/22: auth_authc_result -> auth_authz_success 4d01h: dot1x-sm:Fa0/22:001e.6847.9261:auth_authz_success_enter called 4d01h: dot1x-ev:dot1x_switch_supplicant_add: Adding 001e.6847.9261 on FastEthernet0/22 in vlan 200, domain is DATA 4d01h: dot1x-ev:dot1x_switch_addr_add: Added MAC 001e.6847.9261 to vlan 200 on interface FastEthernet0/22 4d01h: dot1x-ev:dot1x_switch_is_dot1x_forwarding_enabled: Forwarding is disabled on Fa0/22 4d01h: dot1x-ev:ignored vlan 200 vp is added on interface FastEthernet0/22 4d01h: dot1x-ev:dot1x_switch_is_dot1x_forwarding_enabled: Forwarding is disabled on Fa0/22 4d01h: dot1x-ev:dot1x_switch_port_authorized: set dot1x ask handler on interface FastEthernet0/22 4d01h: dot1x-ev:Received successful Authz complete for 001e.6847.9261 4d01h: dot1x-sm:Posting AUTHZ_SUCCESS on Client=1A6F44C 4d01h: dot1x_auth Fa0/22: during state auth_authz_success, got event 26(authzSuccess) 4d01h: @@@ dot1x_auth Fa0/22: auth_authz_success -> auth_authenticated 4d01h: dot1x-sm:Fa0/22:001e.6847.9261:auth_authenticated_enter called 4d01h: dot1x-ev:FastEthernet0/22:Sending EAPOL packet to group PAE address 4d01h: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on FastEthernet0/22. 4d01h: dot1x-ev:dot1x_mgr_send_eapol: Sending out EAPOL packet on FastEthernet0/22 4d01h: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to up Regards, Luciano Rangel -----Original Message----- From: freeradius-users-bounces+luciano.rangel=logica.com@lists.freeradius.org [mailto:freeradius-users-bounces+luciano.rangel=logica.com@lists.freeradius.org] On Behalf Of Alan Buxey Sent: segunda-feira, 6 de dezembro de 2010 20:45 To: FreeRadius users mailing list Subject: Re: Assign VLAN Hi,
Sending Access-Challenge of id 155 to 10.0.0.3 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "200" EAP-Message = 0x0103001604108840585485ec8c2c8e14826bdf5ec42b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x42b5c77d42b6c3940045ff626d0da231
I would like to know what is wrong with the syntax of my user file for send vlan 0 instead of vlan 200:
what makes you think its sending vlan 0 ?? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
Rangel, Luciano wrote:
I see my switch log.
<sigh> This is the FreeRADIUS list. Post the *radius* debug log, as suggested in the FAQ, README, INSTALL, "man" page, web pages, and daily on this list. It's really not that hard. You're having difficult solving the problem because you're trying to debug the RADIUS server by looking at the switch. This makes *no* sense. Alan DeKok.
Alan, I'm not trying debug logs in switch. I simply answered the question of how I knew that my switch received vlan 0 instead 200. The help I'm asking is: I send attribute Tunnel-Private-Group-Id = "200" with Freeradius and send same attribute with ACS. Why switch interpret differently. I don´t search the problem. My users file in freeradius is correct, debug logs show that freeradius is send attribute correct. Why this not work? Regards, Luciano Rangel -----Original Message----- From: freeradius-users-bounces+luciano.rangel=logica.com@lists.freeradius.org [mailto:freeradius-users-bounces+luciano.rangel=logica.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: terça-feira, 7 de dezembro de 2010 00:29 To: FreeRadius users mailing list Subject: Re: Assign VLAN Rangel, Luciano wrote:
I see my switch log.
<sigh> This is the FreeRADIUS list. Post the *radius* debug log, as suggested in the FAQ, README, INSTALL, "man" page, web pages, and daily on this list. It's really not that hard. You're having difficult solving the problem because you're trying to debug the RADIUS server by looking at the switch. This makes *no* sense. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
Rangel, Luciano wrote:
I'm not trying debug logs in switch.
Then why are you looking at the debug log of the switch? Why are you not looking at the debug log of the server?
I simply answered the question of how I knew that my switch received vlan 0 instead 200.
Did the server *send* VLAN of 200? You've looked at the config files, but have been going to great effort to avoid looking at the debug output.
The help I'm asking is:
I send attribute Tunnel-Private-Group-Id = "200" with Freeradius and send same attribute with ACS. Why switch interpret differently.
No... you *think* you told FreeRADIUS to send VLAN 200. But you never *checked* if it was sending that.
I don´t search the problem. My users file in freeradius is correct, debug logs show that freeradius is send attribute correct.
You've never posted that.
Why this not work?
Because the Access-Accept from ACS is *different* than the Access-Accept from FreeRADIUS. If you make the Access-Accept from FreeRADIUS the same as the Access-Accept from ACS, it *will* work. There's no magic in RADIUS. Use wireshark to look at the packets from ACS. Alan DeKok.
VLAN ID assignment should be done in Access-Accept, not in Access-Challenge. Try to compare Access-Accept sent by Cisco ACS and Access-Accept sent by FreeRADIUS. Rangel, Luciano wrote:
Alan,
In my switch I see that radius send vlan 0 but as Access-chalange send vlan 200 as below.
Sending Access-Challenge of id 155 to 10.0.0.3 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "200" EAP-Message = 0x0103001604108840585485ec8c2c8e14826bdf5ec42b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x42b5c77d42b6c3940045ff626d0da231
We use perl $RAD_REPLY{'Service-Type'} = "Framed-User"; $RAD_REPLY{'Tunnel-Type'} = "VLAN"; $RAD_REPLY{'Tunnel-Medium-Type'} = "IEEE-802"; $RAD_REPLY{'Tunnel-Private-Group-Id'} = "resnet"; Schilling On Thu, Dec 9, 2010 at 10:17 AM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
VLAN ID assignment should be done in Access-Accept, not in Access-Challenge. Try to compare Access-Accept sent by Cisco ACS and Access-Accept sent by FreeRADIUS.
yes - ours is in post-auth session (run via PERL)
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
DEFAULT Auth-Type = ntlm_auth Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 200
who knows..possibly the ORDER of the attributes? we use Tunnel-Medium-Type = "IEEE-802", Tunnel-Type = "VLAN", Tunnel-Private-Group-Id = "200" is your switch one of those wierd ones that wants the NAME of the VLAN rather than its ID? alan
Alan Buxey wrote:
who knows..possibly the ORDER of the attributes?
Any NAS that care about the order of attributes is violating the specifications.
is your switch one of those wierd ones that wants the NAME of the VLAN rather than its ID?
Quite possibly. If he had bothered looking at the Access-Accept from ACS, he would have the answer to that question. Alan DeKok.
Dears, Below Access-Accept from ACS captured by Wireshark: AVP: l=6 t=Tunnel-Type(64) Tag=0x00: VLAN(13) Tag: 0x00 Tunnel-Type: VLAN (13) AVP: l=6 t=Tunnel-Medium-Type(65) Tag=0x00: IEEE-802(6) Tag: 0x00 Tunnel-Medium-Type: IEEE-802 (6) AVP: l=5 t=Tunnel-Private-Group-Id(81): 200 Tunnel-Private-Group-Id: 200 Attribute configured in freeradius users file: DEFAULT Auth-Type = ntlm_auth Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "200" As I said the attribute sent by ACS and Freeradius are the same. I still do not understand why this is not working. It could be some incompatibility between cisco 2960 and Freeradius? Regards, Luciano Rangel -----Original Message----- From: freeradius-users-bounces+luciano.rangel=logica.com@lists.freeradius.org [mailto:freeradius-users-bounces+luciano.rangel=logica.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: quinta-feira, 9 de dezembro de 2010 13:47 To: FreeRadius users mailing list Subject: Re: Assign VLAN Alan Buxey wrote:
who knows..possibly the ORDER of the attributes?
Any NAS that care about the order of attributes is violating the specifications.
is your switch one of those wierd ones that wants the NAME of the VLAN rather than its ID?
Quite possibly. If he had bothered looking at the Access-Accept from ACS, he would have the answer to that question. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
Freeradius Access-Accept: Sending Access-Accept of id 29 to 10.0.0.3 port 1645 MS-MPPE-Recv-Key = 0x88a007eda1d4841ea348c3a0d49fd963e3f188a3f77509c3d3eb045d3a23fa7c MS-MPPE-Send-Key = 0xbe8168ed341e6a4f0332a9d0c8b1893f574e98fa4af7af74dbebf944f687eaf7 EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "GROUPINFRA\\rangell" Finished request 10. I don´t see attributes (VLAN, IEEE-802 and 200) in freerdius access-accept, but in a stretch of logs I see messages below: Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok Login OK: [GROUPINFRA\\rangell] (from client switch-2960 port 0 via TLS tunnel) WARNING: Empty section. Using default return values. } # server inner-tunnel [peap] Got tunneled reply code 2 Service-Type = Framed-User Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "200" EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "GROUPINFRA\\rangell" [peap] Got tunneled reply RADIUS code 2 Service-Type = Framed-User Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "200" EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "GROUPINFRA\\rangell" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 28 to 10.0.0.3 port 1645 EAP-Message = 0x010c00261900170301001b0472c7380855a9fa41e49897807ecfeecbf7e6868eb3fe9540e8a3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd32e175dda220e5c8cbe3424bc53aa13 Finished request 9. Regards, Luciano Rangel Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
I haven't read this thread line by line, but I'd say start with the most simple config first - the users file. Forget everything else until 802.1x VLAN assignments work correctly from there. I started down this path a year'ish ago and only got to the testing phase before the project (ie: me) lost momentum. But, the confs are still there and I'll post mine that worked with our 2960's. But again, it's very simple: 99% default settings, only minor changes to the users and clients file to support my environment. I'll try to get to this tomorrow. G -----Original Message----- From: freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org] On Behalf Of Rangel, Luciano Sent: Thursday, December 09, 2010 4:30 PM To: FreeRadius users mailing list Subject: RE: Assign VLAN Freeradius Access-Accept: Sending Access-Accept of id 29 to 10.0.0.3 port 1645 MS-MPPE-Recv-Key = 0x88a007eda1d4841ea348c3a0d49fd963e3f188a3f77509c3d3eb045d3a23fa7c MS-MPPE-Send-Key = 0xbe8168ed341e6a4f0332a9d0c8b1893f574e98fa4af7af74dbebf944f687eaf7 EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "GROUPINFRA\\rangell" Finished request 10. I don´t see attributes (VLAN, IEEE-802 and 200) in freerdius access-accept, but in a stretch of logs I see messages below: Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok Login OK: [GROUPINFRA\\rangell] (from client switch-2960 port 0 via TLS tunnel) WARNING: Empty section. Using default return values. } # server inner-tunnel [peap] Got tunneled reply code 2 Service-Type = Framed-User Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "200" EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "GROUPINFRA\\rangell" [peap] Got tunneled reply RADIUS code 2 Service-Type = Framed-User Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "200" EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "GROUPINFRA\\rangell" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 28 to 10.0.0.3 port 1645 EAP-Message = 0x010c00261900170301001b0472c7380855a9fa41e49897807ecfeecbf7e6868eb3fe9540e8a3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd32e175dda220e5c8cbe3424bc53aa13 Finished request 9. Regards, Luciano Rangel Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
Hi,
Freeradius Access-Accept:
Sending Access-Accept of id 29 to 10.0.0.3 port 1645 MS-MPPE-Recv-Key = 0x88a007eda1d4841ea348c3a0d49fd963e3f188a3f77509c3d3eb045d3a23fa7c MS-MPPE-Send-Key = 0xbe8168ed341e6a4f0332a9d0c8b1893f574e98fa4af7af74dbebf944f687eaf7 EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "GROUPINFRA\\rangell" Finished request 10.
I don´t see attributes (VLAN, IEEE-802 and 200) in freerdius access-accept, but in a stretch of logs I see messages below:
copy the PEAP tunnel attributes to the outer - if you read eap.conf that is provided with default config you will see the option to set that to 'yes' alan
I change the options copy_request_to_tunnel and use_tunneled_reply to yes in eap.conf (peap section) and it work. Sending Access-Accept of id 180 to 10.0.0.3 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "200" User-Name = "GROUPINFRA\\rangell" MS-MPPE-Recv-Key = 0xb51c2c8aac12b69bfbe31c1e465fd0f467af4c88506f8dcf510ea66826a31669 MS-MPPE-Send-Key = 0xcb5f1f33817d2fae734542c23733f3432dd320c2e52a7e8da192916ec6381237 EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 10. THANKS FOR HELP AND PATIENCE FROM ALL AND SORRY FOR THE LETTLE KNOWLEDGE ON FREERADIUS. Best Regards, Luciano Rangel -----Original Message----- From: freeradius-users-bounces+luciano.rangel=logica.com@lists.freeradius.org [mailto:freeradius-users-bounces+luciano.rangel=logica.com@lists.freeradius.org] On Behalf Of Alan Buxey Sent: quinta-feira, 9 de dezembro de 2010 21:24 To: FreeRadius users mailing list Subject: Re: Assign VLAN Hi,
Freeradius Access-Accept:
Sending Access-Accept of id 29 to 10.0.0.3 port 1645 MS-MPPE-Recv-Key = 0x88a007eda1d4841ea348c3a0d49fd963e3f188a3f77509c3d3eb045d3a23fa7c MS-MPPE-Send-Key = 0xbe8168ed341e6a4f0332a9d0c8b1893f574e98fa4af7af74dbebf944f687eaf7 EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "GROUPINFRA\\rangell" Finished request 10.
I don´t see attributes (VLAN, IEEE-802 and 200) in freerdius access-accept, but in a stretch of logs I see messages below:
copy the PEAP tunnel attributes to the outer - if you read eap.conf that is provided with default config you will see the option to set that to 'yes' alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
Rangel, Luciano wrote:
I change the options copy_request_to_tunnel and use_tunneled_reply to yes in eap.conf (peap section) and it work.
That's good to hear.
THANKS FOR HELP AND PATIENCE FROM ALL AND SORRY FOR THE LETTLE KNOWLEDGE ON FREERADIUS.
We understand that not everyone is an expert. But look at what happened: very shortly after posting the debug output, the problem was solved. Posting the debug output takes *no* knowledge, just the ability to follow instructions. Prior to that, there were days of arguing *because* you weren't looking at the debug output... even when you were told to. *Always* look at the debug output. Really. We can't say this enough. Alan DeKok.
Alan, I´m using a catalyst 2960 for EAPOL authentication. I will go change the order in my users file for test. Regards, Luciano Rangel -----Original Message----- From: freeradius-users-bounces+luciano.rangel=logica.com@lists.freeradius.org [mailto:freeradius-users-bounces+luciano.rangel=logica.com@lists.freeradius.org] On Behalf Of Alan Buxey Sent: quinta-feira, 9 de dezembro de 2010 13:16 To: FreeRadius users mailing list Subject: Re: Assign VLAN Hi,
DEFAULT Auth-Type = ntlm_auth Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 200
who knows..possibly the ORDER of the attributes? we use Tunnel-Medium-Type = "IEEE-802", Tunnel-Type = "VLAN", Tunnel-Private-Group-Id = "200" is your switch one of those wierd ones that wants the NAME of the VLAN rather than its ID? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
participants (6)
-
Alan Buxey -
Alan DeKok -
Gary Gatten -
Iliya Peregoudov -
Rangel, Luciano -
schilling