Re: Using freeradius and 802.1x for dynamic VLAN
you certainly arent checking that the VLAN is 2 - and if it isnt then fail the authentication. i can understand what you are trying to do...but do do THAT sort of thing you will need to use checking attributes, not setting attributes.
you should find that the port which carlos is attached to is being put onto VLAN 2 is the config is correct.
How do I know if my certificate checking that the vlan is 2 and why the authentication don't fail? What certificate i shoud use, so that valid the: carlos User-Password == "carlos" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2 and if the user carlos access to the vlan 2, he can access, otherwise he doesn't access. But in my case the user carlos can access to any vlan. for example to vlan 3 or 4. Tell me what certificate I can to use that valid the Tunnel-Type and form it. ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.
lvizcardof@unsa.edu.pe wrote: ...
What certificate i shoud use, so that valid the: carlos User-Password == "carlos" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2
and if the user carlos access to the vlan 2, he can access, otherwise he doesn't access.
RADIUS doesn't work that way. The NAS doesn't tell the server what VLAN the user is in, because the user is NOT in a VLAN until they have been authenticated. Alan DeKok.
Alan DeKok wrote:
lvizcardof@unsa.edu.pe wrote: ...
What certificate i shoud use, so that valid the: carlos User-Password == "carlos" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2
and if the user carlos access to the vlan 2, he can access, otherwise he doesn't access.
RADIUS doesn't work that way. The NAS doesn't tell the server what VLAN the user is in, because the user is NOT in a VLAN until they have been authenticated.
Not true, see HPs Open VLAN feature. The NAS may also request that the supplicant be put into a certain VLAN based on the static VLAN assignment on the port the supplicant is connecting to. rad_recv: Access-Request packet from host 139.184.9.175 port 1024, id=119, length=306 Framed-MTU = 1480 NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Identifier = "xxxxxxxxxxxxxx" User-Name = "xxx" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 28 NAS-Port-Type = Ethernet NAS-Port-Id = "28" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx"" Connect-Info = "CONNECT Ethernet 10Mbps Half duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x20f6a63dccf5843da5b75a3deaca3c2d EAP-Message = Message-Authenticator = Of course whether the Server decides to honor the NAS's request is another matter.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
Arran Cudbard-Bell wrote:
Not true, see HPs Open VLAN feature. The NAS may also request that the supplicant be put into a certain VLAN based on the static VLAN assignment on the port the supplicant is connecting to.
Wild. I hadn't seen that before. In any case, the original poster hasn't configured a "check vlan" policy, and hasn't showed via "radiusd -X" that the client is in fact sending vlan information. Alan DeKok.
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
lvizcardof＠unsa.edu.pe