IP assignment based on AD group
Hi, I currently have vlan assignment based on ad group working flawlessly for my wireless clients. Now I want ip assignment, is it possible? I tried to achieve that with the ippool module but I think I am missing something. How should I configure the wlc or the dhcp server? mods-enabled/ippool ippool professores-cstsi { filename = ${db_dir}/ippools/professores-cstsi.ippool range_start = 172.17.10.1 range_stop = 172.17.10.20 netmask = 255.255.0.0 cache_size = 20 ip_index = ${db_dir}/ippools/professores-cstsi.ipindex override = yes maximum_timeout = 0 } users DEFAULT LDAP-Group == "test", Pool-Name := "professores-cstsi" Thanks.
On Oct 30, 2024, at 9:10 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Hi, I currently have vlan assignment based on ad group working flawlessly for my wireless clients. Now I want ip assignment, is it possible?
Only via DHCP. You can't return IPs via RADIUS for wireless clients.
I tried to achieve that with the ippool module but I think I am missing something. How should I configure the wlc or the dhcp server?
The IPs need to be assigned by the DHCP server. You can use FreeRADIUS for DHCP. :) Alan DeKok.
Citando Alan DeKok <aland@deployingradius.com>:
On Oct 30, 2024, at 9:10 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Hi, I currently have vlan assignment based on ad group working flawlessly for my wireless clients. Now I want ip assignment, is it possible?
Only via DHCP. You can't return IPs via RADIUS for wireless clients.
I tried to achieve that with the ippool module but I think I am missing something. How should I configure the wlc or the dhcp server?
The IPs need to be assigned by the DHCP server. You can use FreeRADIUS for DHCP. :)
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yes, all my ips are assigned by the dhcp server, it is a PFSense ISC. Can't I configure freeradius to tell the DHCP server which ips it should assign, or something like that?
On Oct 30, 2024, at 10:29 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Yes, all my ips are assigned by the dhcp server, it is a PFSense ISC. Can't I configure freeradius to tell the DHCP server which ips it should assign, or something like that?
How would that work? Does the pfsense documentation say there's an API to allocate IP addresses? There's "omshell", but it seems to be pretty limited in what it can do. So the answer here is likely "no". Because the ISC DHCP server doesn't have any API which allows this. And it can't query an SQL database because it's extremely limited. Alan DeKok.
Citando Alan DeKok <aland@deployingradius.com>:
On Oct 30, 2024, at 10:29 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Yes, all my ips are assigned by the dhcp server, it is a PFSense ISC. Can't I configure freeradius to tell the DHCP server which ips it should assign, or something like that?
How would that work? Does the pfsense documentation say there's an API to allocate IP addresses?
There's "omshell", but it seems to be pretty limited in what it can do.
So the answer here is likely "no". Because the ISC DHCP server doesn't have any API which allows this. And it can't query an SQL database because it's extremely limited.
Alan DeKok.
-List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
So what the ippool and sqlipool modules for? And the Framed-Pool and Framed-IP-Address attributtes that radius can reply? Just as freeradius can reply the vlan to the wlc, and the wlc gives the right vlan to the client I thought that it could reply the IP and the wlc could give the right IP too.
On Oct 30, 2024, at 10:50 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
So what the ippool and sqlipool modules for? And the Framed-Pool and Framed-IP-Address attributtes that radius can reply?
There are some situations where RADIUS can assign the IP addresses. e.g. PPP, ISPs, etc.
Just as freeradius can reply the vlan to the wlc, and the wlc gives the right vlan to the client I thought that it could reply the IP and the wlc could give the right IP too.
That's not how networks work. The VLAN is assigned by the client (switch, etc.). DHCP is not handled by the switch. So you can't give an IP to the switch and expect it to work. Alan DeKok.
Citando Alan DeKok <aland@deployingradius.com>:
On Oct 30, 2024, at 10:50 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
So what the ippool and sqlipool modules for? And the Framed-Pool and Framed-IP-Address attributtes that radius can reply?
There are some situations where RADIUS can assign the IP addresses. e.g. PPP, ISPs, etc.
Just as freeradius can reply the vlan to the wlc, and the wlc gives the right vlan to the client I thought that it could reply the IP and the wlc could give the right IP too.
That's not how networks work.
The VLAN is assigned by the client (switch, etc.). DHCP is not handled by the switch. So you can't give an IP to the switch and expect it to work.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ok, so what it is doing in this guide? https://wiki.freeradius.org/guide/Ippool-and-radius-clients It looks a lot of what I would like. There is a wireless client that asks for ip to the dhcp server, the dhcpserver then sends an access request to freeradius which replies with the right IP for the wireless client.
On Oct 30, 2024, at 11:10 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Ok, so what it is doing in this guide? https://wiki.freeradius.org/guide/Ippool-and-radius-clients
It looks a lot of what I would like.
Are you running mikrotik equipment? No? Then it won't work. That Wiki page is extremely clear on that.
There is a wireless client that asks for ip to the dhcp server, the dhcpserver then sends an access request to freeradius which replies with the right IP for the wireless client.
Yes, you've said this over and over and over again. I really don't know how to explain this. Read the pfsense documentation to see what it does. If it doesn't say it can do DHCP to RADIUS, then it can't do it. You've been told this isn't a FreeRADIUS issue. Go look into the pfsense documentation, and stop asking the same question here over and over again. This isn't a productive use of your time. Alan DeKok.
Citando Alan DeKok <aland@deployingradius.com>:
On Oct 30, 2024, at 11:10 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Ok, so what it is doing in this guide? https://wiki.freeradius.org/guide/Ippool-and-radius-clients
It looks a lot of what I would like.
Are you running mikrotik equipment? No? Then it won't work. That Wiki page is extremely clear on that.
The wiki says the opposite actually. "The example here is based on a using a Mikrotik router client but the principles are the same as for any client."
There is a wireless client that asks for ip to the dhcp server, the dhcpserver then sends an access request to freeradius which replies with the right IP for the wireless client.
Yes, you've said this over and over and over again. I really don't know how to explain this.
Read the pfsense documentation to see what it does. If it doesn't say it can do DHCP to RADIUS, then it can't do it.
You've been told this isn't a FreeRADIUS issue. Go look into the pfsense documentation, and stop asking the same question here over and over again. This isn't a productive use of your time.
No, I'm talking about the case in the wiki: There is a wireless client that asks for ip to the dhcp server, the dhcpserver then sends an access request to freeradius which replies with the right IP for the wireless client. That case looks a lot like mine, thats why I didn't undestood why you said is impossible for radius to assign ip to clients with dhcp. I just wanted to know why.
On Wed, 30 Oct 2024, Rodrigo Abrantes Antunes wrote:
Citando Alan DeKok <aland@deployingradius.com>:
On Oct 30, 2024, at 11:10 AM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Ok, so what it is doing in this guide? https://wiki.freeradius.org/guide/Ippool-and-radius-clients
It looks a lot of what I would like.
Are you running mikrotik equipment? No? Then it won't work. That Wiki page is extremely clear on that.
The wiki says the opposite actually.
"The example here is based on a using a Mikrotik router client but the principles are the same as for any client."
That specific text from that page: "principles are the same as for any client." is a bit misleading insofar as it's talking about 'any client' which is an integrated wireless-AP+router+DHCP-server in one box (EG the mikrotik). The box being used needs to understand radius AND can note the Framed-IP attributes in the access request reply AND store them in its internal DHCP server's database AND will hand that back to the client WHEN the client sends a DHCP request to the 'router'.
There is a wireless client that asks for ip to the dhcp server, the dhcpserver then sends an access request to freeradius which replies with the right IP for the wireless client.
[snip..]
No, I'm talking about the case in the wiki: There is a wireless client that asks for ip to the dhcp server, the dhcpserver then sends an access request to freeradius which replies with the right IP for the wireless client.
That case looks a lot like mine, thats why I didn't undestood why you said is impossible for radius to assign ip to clients with dhcp. I just wanted to know why.
The DHCP server never sends an access request to freeradius. The access request happens at the EAPOL level, the AP talking to FR. If the AP and DHCP server are "joined at the hip" in the same device then you can get this integrated functionality. If you're using classical stand-alone APs and classical separate DHCP server (EG an ISC based critter) then you do NOT have the infrastructure which that wiki article is talking about. -- Dave Funk University of Iowa <dbfunk (at) engineering.uiowa.edu> College of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center, 103 S Capitol St. Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 #include <std_disclaimer.h> Better is not better, 'standard' is better. B{
On Oct 30, 2024, at 12:03 PM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Are you running mikrotik equipment? No? Then it won't work. That Wiki page is extremely clear on that.
The wiki says the opposite actually.
So you don't understand how things work, but you think you know better than people who do understand how things work?
No, I'm talking about the case in the wiki: There is a wireless client that asks for ip to the dhcp server, the dhcpserver then sends an access request to freeradius which replies with the right IP for the wireless client.
That case looks a lot like mine, thats why I didn't undestood why you said is impossible for radius to assign ip to clients with dhcp. I just wanted to know why.
I has been explained to you repeatedly: pfsense doesn't have that functionality. At this point, I have to give up on this subject. You've been told repeatedly why it doesn't work. You've been told that this isn't a FreeRADIUS issue. This subject is off topic for the FreeRADIUS list. Any more non-FreeRADIUS questions will result in you being removed from the list. Alan DeKok.
Citando Alan DeKok <aland@deployingradius.com>:
On Oct 30, 2024, at 12:03 PM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Are you running mikrotik equipment? No? Then it won't work. That Wiki page is extremely clear on that.
The wiki says the opposite actually.
So you don't understand how things work, but you think you know better than people who do understand how things work?
Men, you said the wiki is clear in saying that this only work with mikrotik. But then the wiki says this: "The example here is based on using a Mikrotik router client but the principles are the same as for any client." This is clearly misleading, the wiki is clearly saying that this could work with other clients besides mikrotik. You should fix the wiki then. I never said that that I know anything better that anyone, I only said what is said in the wiki. Fix that.
No, I'm talking about the case in the wiki: There is a wireless client that asks for ip to the dhcp server, the dhcpserver then sends an access request to freeradius which replies with the right IP for the wireless client.
That case looks a lot like mine, thats why I didn't undestood why you said is impossible for radius to assign ip to clients with dhcp. I just wanted to know why.
I has been explained to you repeatedly: pfsense doesn't have that functionality.
At this point, I have to give up on this subject. You've been told repeatedly why it doesn't work. You've been told that this isn't a FreeRADIUS issue.
This subject is off topic for the FreeRADIUS list. Any more non-FreeRADIUS questions will result in you being removed from the list.
In the first mail I said I want to control ip assignment based on ad groups with freeradius and then you said this is impossible no matter what I asked. You could have said the cases where this is possible, you could have said: you can achieve exactly what you want with mikrotik dhcp or using freeradius as dhcp server or using vpn. Currently I have pfsense as dhcp server, but if I can achieve my goal with freeradius dhcp I will switch to that. You could have said that in the first email, you only said that freeradius can be a DHCP server, you never said that using freeradius as DHCP server I could achieve what I wanted.
From: Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> "Citando Alan DeKok <aland@deployingradius.com>:
On Oct 30, 2024, at 12:03 PM, Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br> wrote:
Are you running mikrotik equipment? No? Then it won't work. That Wiki page is extremely clear on that.
The wiki says the opposite actually.
So you don't understand how things work, but you think you know better than people who do understand how things work?
Men, you said the wiki is clear in saying that this only work with mikrotik. But then the wiki says this: "The example here is based on using a Mikrotik router client but the principles are the same as for any client." This is clearly misleading, the wiki is clearly saying that this could work with other clients besides mikrotik. You should fix the wiki then. I never said that that I know anything better that anyone, I only said what is said in the wiki. Fix that." Rodrigo, better than starting some fiery discussion about what the freeradius team should do, is to send a concrete proposal, how, for example, the text in the wiki should be changed. Write only to freeradius staff just fix it is very simple. Freeradius staff do really very good work. Petr
From: Freeradius-Users <freeradius-users-bounces+bjulin=clarku.edu@lists.freeradius.org> on behalf of Rodrigo Abrantes Antunes <rodrigoantunes@pelotas.ifsul.edu.br>
Yes, all my ips are assigned by the dhcp server, it is a PFSense ISC. Can't I configure freeradius to tell the DHCP server which ips it should assign, or something like that?
FreeRADIUS has various ways of running scripts, using REST APIs, storing information in databases, or sending logs. However, what integrations PFSense has to map MAC addresses to usernames/groups or preferred IP pools is really something that needs to be asked of their support, not here.
participants (5)
-
Alan DeKok -
Brian Julin -
Dave Funk -
petr.linke＠seznam.cz -
Rodrigo Abrantes Antunes