Sending Avaya-Fabric-Attach-VLAN-ISID and Avaya-Fabric-Attach-VLAN-PVID after successful authentication
Hello, I have a cluster of freeradius servers running with an LDAP backend which all works fine. I'm also able to return the correct VLAN information after a successful authentication of a client. That way I can put clients in the correct VLAN based on the authentication / authorization matrix etc. Very nice. In my core network I have Avaya / Extreme VSP 7000 switches in SPBM mode and I would like to configure a port on those switches after successful authentication, but they don't want VLAN information, but they want something else: VSAs • Avaya-Fabric-Attach-VLAN-ISID • Avaya-Auto-VLAN-Create • Avaya-Fabric-Attach-VLAN-PVID Documentation about this states the following: Avaya-Fabric-Attach-VLAN-ISID - This VSA consists of a (VLAN, I-SID) pair. Multiple (VLAN, I-SID) pairs are processed only in MHSA mode. Avaya-Auto-VLAN-Create - If this VSA is set to TRUE, the VLANs received in all (VLAN, I-SID) pairs will be automatically created if they do not exist. This VSA is processed only in MHSA and MHMV modes. Avaya-Fabric-Attach-VLAN-PVID - This VSA contains the value of the PVID that should be set on the port with the authenticated client. The Avaya-Fabric-Attach-VLAN-PVID VSA is processed only in MHSA mode. The switch send the following in an access request packet: VSAs sent from switch to RADIUS server: • Avaya-Fabric-Attach-Mode This VSA can have the following values: - 0 or not sent, when Switch is assumed to have no concept of SPB/AutoProv - 1, when the switch is an FA Server in VLAN provision mode - 2, when the switch is an FA Server in SPBM mode - 3, when the switch is an FA Proxy with the connected FA Server in VLAN provision mode - 4, when the switch is an FA Proxy with the connected FA Server in SPBM mode - 5 , when the switch is a FA Standalone Proxy • Avaya-Fabric-Attach-Client-Type This VSA can have the following values: - 1, FA Element Type Other - 2, FA Server - 3, FA Proxy - 4, FA Server No Authentication - 5, FA Proxy No Authentication - 6, FA Client – Wireless AP Type 1 [clients direct network attachment] - 7, FA Client – Wireless Ap Type 2 [clients tunneled to controller] • Avaya-Fabric-Attach-Client-Id This VSA contains the MAC address of the FA client, exported via FA Signaling. Does FreeRadius currently support this anywhere in a version? Is there a way to get this working by correctly filling the dictionary file? The man page for the dictionary file states that the VSA's configured there will never be send in a radius packet, which makes me suspect that this won't work? Documentation on this can be found in https://downloads.avaya.com/css/P8/documents/101026369 Thank you very much. Jan Hugo Prins
On Oct 15, 2019, at 8:29 AM, Jan Hugo Prins <jhp@jhprins.org> wrote:
I have a cluster of freeradius servers running with an LDAP backend which all works fine. I'm also able to return the correct VLAN information after a successful authentication of a client. That way I can put clients in the correct VLAN based on the authentication / authorization matrix etc. Very nice.
That's good.
In my core network I have Avaya / Extreme VSP 7000 switches in SPBM mode and I would like to configure a port on those switches after successful authentication, but they don't want VLAN information, but they want something else:
VSAs • Avaya-Fabric-Attach-VLAN-ISID • Avaya-Auto-VLAN-Create • Avaya-Fabric-Attach-VLAN-PVID
Documentation about this states the following:
Note: nothing about vendor or attribute numbers. <sigh>
Does FreeRadius currently support this anywhere in a version? Is there a way to get this working by correctly filling the dictionary file?
Fill in the correct dictionary file with the correct numbers, and it will work.
The man page for the dictionary file states that the VSA's configured there will never be send in a radius packet, which makes me suspect that this won't work?
The man page doesn't say that. The only attributes which don't get sent in a RADIUS packet are the ones defined in raddb/dictionary. That file explains this, too.
Documentation on this can be found in https://downloads.avaya.com/css/P8/documents/101026369
If you can find documentation on the attribute numbers, we can add it to the dictionaries. I really wish that vendors would just send us their dictionaries. Or even document them. But apparently no, they hate their customers. Alan DeKok.
Hello Alan, I found the following information in a forum on the Extreme Networking site: # # /usr/share/freeradius/dictionary.nortel # VENDOR Nortel 562 BEGIN-VENDOR Nortel ATTRIBUTE Fabric-Attach-VLAN-Create 170 integer ATTRIBUTE Fabric-Attach-VLAN-ISID 171 string ATTRIBUTE Fabric-Attach-VLAN-PVID 172 integer VALUE Fabric-Attach-VLAN-Create No 0 VALUE Fabric-Attach-VLAN-Create Yes 1 VALUE Fabric-Attach-VLAN-ISID VALUE Fabric-Attach-VLAN-PVID With an example: # Create and assing Vlan 11 untagged 00-00-70-70-AA-BB Fabric-Attach-VLAN-Create = "Yes", Fabric-Attach-VLAN-ISID = "11:10011", Fabric-Attach-VLAN-PVID = "11" I'm going to test it tomorrow in my setup, but I would like to know one thing. Can I just add the above dictionary information to the /etc/raddb/dictionary file, or do I need to extend the dictionary.nortel file with this information? Thanks in advance, Jan Hugo Prins On 10/15/19 3:42 PM, Alan DeKok wrote:
On Oct 15, 2019, at 8:29 AM, Jan Hugo Prins <jhp@jhprins.org> wrote:
I have a cluster of freeradius servers running with an LDAP backend which all works fine. I'm also able to return the correct VLAN information after a successful authentication of a client. That way I can put clients in the correct VLAN based on the authentication / authorization matrix etc. Very nice. That's good.
In my core network I have Avaya / Extreme VSP 7000 switches in SPBM mode and I would like to configure a port on those switches after successful authentication, but they don't want VLAN information, but they want something else:
VSAs • Avaya-Fabric-Attach-VLAN-ISID • Avaya-Auto-VLAN-Create • Avaya-Fabric-Attach-VLAN-PVID
Documentation about this states the following: Note: nothing about vendor or attribute numbers. <sigh>
Does FreeRadius currently support this anywhere in a version? Is there a way to get this working by correctly filling the dictionary file? Fill in the correct dictionary file with the correct numbers, and it will work.
The man page for the dictionary file states that the VSA's configured there will never be send in a radius packet, which makes me suspect that this won't work? The man page doesn't say that. The only attributes which don't get sent in a RADIUS packet are the ones defined in raddb/dictionary. That file explains this, too.
Documentation on this can be found in https://downloads.avaya.com/css/P8/documents/101026369 If you can find documentation on the attribute numbers, we can add it to the dictionaries.
I really wish that vendors would just send us their dictionaries. Or even document them. But apparently no, they hate their customers.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello Alan, Some more information, a GTAC with Extreme Networking gave me the following information: Fabric-Attach-VLAN-Create - 170, unsigned 32-bit Fabric-Attach-VLAN-ISID - 171, string Fabric-Attach-VLAN-PVID - 172, unsigned 32-bit Fabric-Attach-Switch-Mode - 180,unsigned 32-bit Fabric-Attach-Client-Id - 181,string Fabric-Attach-Client-Type - 182,string With the mail I send earlier, it looks like we have all information now, just need to know where to put it exactly. Could you add this to the Nortel dictionary in FreeRadius? Thank you very much. Jan Hugo Prins On 10/15/19 3:42 PM, Alan DeKok wrote:
On Oct 15, 2019, at 8:29 AM, Jan Hugo Prins <jhp@jhprins.org> wrote:
I have a cluster of freeradius servers running with an LDAP backend which all works fine. I'm also able to return the correct VLAN information after a successful authentication of a client. That way I can put clients in the correct VLAN based on the authentication / authorization matrix etc. Very nice. That's good.
In my core network I have Avaya / Extreme VSP 7000 switches in SPBM mode and I would like to configure a port on those switches after successful authentication, but they don't want VLAN information, but they want something else:
VSAs • Avaya-Fabric-Attach-VLAN-ISID • Avaya-Auto-VLAN-Create • Avaya-Fabric-Attach-VLAN-PVID
Documentation about this states the following: Note: nothing about vendor or attribute numbers. <sigh>
Does FreeRadius currently support this anywhere in a version? Is there a way to get this working by correctly filling the dictionary file? Fill in the correct dictionary file with the correct numbers, and it will work.
The man page for the dictionary file states that the VSA's configured there will never be send in a radius packet, which makes me suspect that this won't work? The man page doesn't say that. The only attributes which don't get sent in a RADIUS packet are the ones defined in raddb/dictionary. That file explains this, too.
Documentation on this can be found in https://downloads.avaya.com/css/P8/documents/101026369 If you can find documentation on the attribute numbers, we can add it to the dictionaries.
I really wish that vendors would just send us their dictionaries. Or even document them. But apparently no, they hate their customers.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Jan Hugo Prins