Default vs Inner-tunnel concepts
Dear, I want to use eap with TLS authentication in Freeradius. At this moment, I've setup both default and inner.-tunnel files, and everything works OK. Am I right or do I have to use just inner-tunnel file? Please can you help me in this concept? Because I think if I have to use eap with TLS, I have to edit default and inner tunnel files, but maybe I'm wrong and I just have to edit inner-tunnel file and let default file as it comes from package installation. Special thanks, TOM
On Oct 19, 2017, at 9:08 AM, Tom Yard <tomyyard@gmail.com> wrote:
Dear, I want to use eap with TLS authentication in Freeradius.
At this moment, I've setup both default and inner.-tunnel files, and everything works OK.
Am I right or do I have to use just inner-tunnel file?
You need both virtual servers.
Please can you help me in this concept?
Read the comments. They describe what the virtual servers do.
Because I think if I have to use eap with TLS, I have to edit default and inner tunnel files, but maybe I'm wrong and I just have to edit inner-tunnel file and let default file as it comes from package installation.
If it works, you configured it correctly. Alan DeKok.
OK Alan, thank you....but suppose I need to create a second custom virtual server for eap with TLS too, called for example "wifi" and "wifi-tunnel"....where do I have to define them in order to be read??? client 10.2.0.1 { secret = secret shortname = WLC nastype = cisco virtual_server = wifi virtual_server = wifi-tunnel } Is this OK ? Thanks again. TOM 2017-10-19 10:12 GMT-03:00 Alan DeKok <aland@deployingradius.com>:
On Oct 19, 2017, at 9:08 AM, Tom Yard <tomyyard@gmail.com> wrote:
Dear, I want to use eap with TLS authentication in Freeradius.
At this moment, I've setup both default and inner.-tunnel files, and everything works OK.
Am I right or do I have to use just inner-tunnel file?
You need both virtual servers.
Please can you help me in this concept?
Read the comments. They describe what the virtual servers do.
Because I think if I have to use eap with TLS, I have to edit default and inner tunnel files, but maybe I'm wrong and I just have to edit inner-tunnel file and let default file as it comes from package installation.
If it works, you configured it correctly.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Oct 19, 2017, at 9:51 AM, Tom Yard <tomyyard@gmail.com> wrote:
OK Alan, thank you....but suppose I need to create a second custom virtual server for eap with TLS too, called for example "wifi" and "wifi-tunnel"....where do I have to define them in order to be read???
The better question is why do you need to do that, and what are you trying to do?
client 10.2.0.1 { secret = secret shortname = WLC nastype = cisco virtual_server = wifi virtual_server = wifi-tunnel }
Is this OK ?
No. You can't list "virtual_server" twice, and expect it to magically work. The default configuration doesn't do this, either. The references to "inner-tunnel" are in raddb/mods-available/eap. Go read the comments there to see how it works. Alan DeKok.
Dear, I've read about define a separate inner-tunnel virtual server and I did this: In the "wifi" virtual server I call the "wifi-tunnel" virtual server: if (LDAP-Group == "WiFi") { update control { Virtual-Server := "wifi-tunnel" } ok } else { reject } } In "wifi-tunnel" virtual server: if (LDAP-Group == "WiFi-Corp") { update reply { Reply-Message = "Access enabled" } ok } else { reject } But in debug I see this warning, so "wifi" virtual server doesn't call to "wifi-tunnel" virtual server, so I think I don't have the eap with TLS capacity, I have Freeradius 2.2.5: WARNING: You are modifying the value of virtual attribute Virtual-Server. This is not supported. Did I do this in a wrong way ??? Thanks a lot, TOM 2017-10-19 11:08 GMT-03:00 Alan DeKok <aland@deployingradius.com>:
On Oct 19, 2017, at 9:51 AM, Tom Yard <tomyyard@gmail.com> wrote:
OK Alan, thank you....but suppose I need to create a second custom
virtual
server for eap with TLS too, called for example "wifi" and "wifi-tunnel"....where do I have to define them in order to be read???
The better question is why do you need to do that, and what are you trying to do?
client 10.2.0.1 { secret = secret shortname = WLC nastype = cisco virtual_server = wifi virtual_server = wifi-tunnel }
Is this OK ?
No. You can't list "virtual_server" twice, and expect it to magically work. The default configuration doesn't do this, either.
The references to "inner-tunnel" are in raddb/mods-available/eap. Go read the comments there to see how it works.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Oct 20, 2017, at 10:21 AM, Tom Yard <tomyyard@gmail.com> wrote:
Dear, I've read about define a separate inner-tunnel virtual server
The inner-tunnel virtual server is run from the "eap" module. Read raddb/mods-available/eap for more information.
and I did this:
In the "wifi" virtual server I call the "wifi-tunnel" virtual server:
if (LDAP-Group == "WiFi") { update control { Virtual-Server := "wifi-tunnel"
That doesn't work. You can't just magically set things, and expect them to do what you want. The way the server works is documented. You can also read the debug output to see when the inner-tunnel virtual server is called.
In "wifi-tunnel" virtual server:
if (LDAP-Group == "WiFi-Corp") { update reply { Reply-Message = "Access enabled" } ok } else { reject }
And that won't work, either.
But in debug I see this warning, so "wifi" virtual server doesn't call to "wifi-tunnel" virtual server, so I think I don't have the eap with TLS capacity, I have Freeradius 2.2.5:
2.2.5 supports EAP-TLS. All of the documentation and examples makes this VERY clear.
WARNING: You are modifying the value of virtual attribute Virtual-Server. This is not supported.
Did I do this in a wrong way ???
Yes. I'll also note that I asked you a question, which you ignored:
The better question is why do you need to do that, and what are you trying to do?
I asked the question because I was trying to help you. Answering it would not only be polite, but would help *you* solve whatever issue you're trying to solve. If you're going to ignore the advice given on this list, I don't see why you would ask questions here. Alan DeKok.
participants (2)
-
Alan DeKok -
Tom Yard