I have been having trouble recently with getting dynamic VLAN assignment working on my Cisco AP. Clients are successfully authenticating with FreeRADIUS. However, they do not seem to be picking up extra attributes from the "users" file (below is the relevant portion of it). wgraeber NT-Password := "XXX" Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 100 The users are just directed to their original VLAN instead of this portion overriding it. When I try to authenticate to the access point with "radtest," I get the following output: # radtest wgraeber XXX 127.0.0.1 10 XXX Sending Access-Request of id 42 to 127.0.0.1 port 1812 User-Name = "wgraeber" User-Password = "XXX" NAS-IP-Address = 127.0.0.1 NAS-Port = 10 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=42, length=37 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = 802 Tunnel-Private-Group-Id:0 = "100" Furthermore, the Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-Id attributes in the console when actually authenticating and watching the output of "radiusd -X" on another machine. The access point *should* support this out of the box according to the Cisco specs. This is my first FreeRADIUS implementation, so I don't know if I'm missing any magic options. Also, I have searched the archives and tried several suggestions to no avail (in eap.conf, copy_request_to_tunnel and use_tunneled_reply under the PEAP segment). I will happily post more configuration options / debug info if needed. Thanks in advance, William
Hi,
I have been having trouble recently with getting dynamic VLAN assignment working on my Cisco AP. Clients are successfully authenticating with FreeRADIUS. However, they do not seem to be picking up extra attributes from the "users" file (below is the relevant portion of it).
wgraeber NT-Password := "XXX" Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 100
those are the attributes you want. Tunnel-Medium-Type = IEEE-802 Tunnel-Type = VLAN Tunnel-Private-Group-Id = 100 a slight difference. alan
I have been having trouble recently with getting dynamic VLAN assignment working on my Cisco AP. Clients are successfully authenticating with FreeRADIUS. However, they do not seem to be picking up extra attributes from the "users" file (below is the relevant portion of it).
wgraeber NT-Password := "XXX" Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 100
The users are just directed to their original VLAN instead of this portion overriding it. When I try to authenticate to the access point with "radtest," I get the following output:
# radtest wgraeber XXX 127.0.0.1 10 XXX Sending Access-Request of id 42 to 127.0.0.1 port 1812 User-Name = "wgraeber" User-Password = "XXX" NAS-IP-Address = 127.0.0.1 NAS-Port = 10 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=42, length=37 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = 802 Tunnel-Private-Group-Id:0 = "100"
Furthermore, the Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-Id attributes in the console when actually authenticating and watching the output of "radiusd -X" on another machine. The access point *should* support this out of the box according to the Cisco specs. This is my first FreeRADIUS implementation, so I don't know if I'm missing any magic options.
You have done what you were suposed to on freeradius. Do debug aaa on Cisco and see what has happened to the attributes. Ivan Kalik Kalik Informatika ISP
Tom was correct, and I have changed the Tunnel-Medium-Type to "6". The corresponding radtest output shows it is correctly translated to "IEEE-802". However, I am still not bumped into the correct VLAN. In the Cisco debug logs, I see these lines: *Mar 1 00:09:30.630: AAA/ATTR(00000000): add attr: 0125E6C0 0 00000001 tunnel-medium-type(336) 4 ALL_802 *Mar 1 00:09:30.630: AAA/ATTR(00000000): add attr: 0125E6D4 0 00000001 tunnel-type(344) 4 VLAN *Mar 1 00:09:30.630: AAA/ATTR(00000000): add attr: 0125E6E8 0 00000009 tunnel-private-group-id(297) 3 100 *Mar 1 00:09:30.634: AAA/ATTR(0000000B): del attr: 0125E6C0 0 00000001 tunnel-medium-type(336) 4 ALL_802 *Mar 1 00:09:30.634: AAA/ATTR(0000000B): del attr: 0125E6D4 0 00000001 tunnel-type(344) 4 VLAN *Mar 1 00:09:30.634: AAA/ATTR(0000000B): del attr: 0125E6E8 0 00000009 tunnel-private-group-id(297) 3 100 The full log may be viewed at: http://dpaste.com/112610/ Also, I have posted my eap.conf here: http://dpaste.com/112615/ and radius.conf here: http://dpaste.com/112616/ and I don't think anyone would need it, but here is clients.conf as well: http://dpaste.com/112618/ I am using FreeRADIUS version 2.0.5 on OpenBSD 4.4. I'm sure that there is something simple that I am missing, but I'm new to both the RADIUS protocol and Cisco access points. I luckily was able to score several 1130ag's cheap for personal use during an auction from the presidential campaign. Thanks again, William On Fri, Jan 23, 2009 at 11:30, <tnt@kalik.net> wrote:
I have been having trouble recently with getting dynamic VLAN assignment working on my Cisco AP. Clients are successfully authenticating with FreeRADIUS. However, they do not seem to be picking up extra attributes from the "users" file (below is the relevant portion of it).
wgraeber NT-Password := "XXX" Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 100
The users are just directed to their original VLAN instead of this portion overriding it. When I try to authenticate to the access point with "radtest," I get the following output:
# radtest wgraeber XXX 127.0.0.1 10 XXX Sending Access-Request of id 42 to 127.0.0.1 port 1812 User-Name = "wgraeber" User-Password = "XXX" NAS-IP-Address = 127.0.0.1 NAS-Port = 10 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=42, length=37 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = 802 Tunnel-Private-Group-Id:0 = "100"
Furthermore, the Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-Id attributes in the console when actually authenticating and watching the output of "radiusd -X" on another machine. The access point *should* support this out of the box according to the Cisco specs. This is my first FreeRADIUS implementation, so I don't know if I'm missing any magic options.
You have done what you were suposed to on freeradius. Do debug aaa on Cisco and see what has happened to the attributes.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
The full log may be viewed at: http://dpaste.com/112610/
Also, I have posted my eap.conf here: http://dpaste.com/112615/
and radius.conf here: http://dpaste.com/112616/
and I don't think anyone would need it, but here is clients.conf as well: http://dpaste.com/112618/
You have posted everything apart from the most important thing - radiusd -X debug. I can see those tunnel attributes on Cisco debug but not in the Access-Accept packet (the one with MPPE keys). Ivan Kalik Kalik Informatika ISP
Here is the output of a client associating immediately after the server starts: http://dpaste.com/112843/ Also, I am new to IOS, and there was no "debug aaa on" command. If you look closely at the top of the file I previously posted, I turned on about half of the options I thought relevant to debugging to aaa. I don't know if this would have an effect one showing what was relevant. I really appreciate the help everyone has given thus far. -William On Sun, Jan 25, 2009 at 04:23, <tnt@kalik.net> wrote:
The full log may be viewed at: http://dpaste.com/112610/
Also, I have posted my eap.conf here: http://dpaste.com/112615/
and radius.conf here: http://dpaste.com/112616/
and I don't think anyone would need it, but here is clients.conf as well: http://dpaste.com/112618/
You have posted everything apart from the most important thing - radiusd -X debug. I can see those tunnel attributes on Cisco debug but not in the Access-Accept packet (the one with MPPE keys).
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
William Graeber wrote:
Here is the output of a client associating immediately after the server starts: http://dpaste.com/112843/
You're not assigning the attributes that tell the server to put the user into a VLAN. Are you using the *default* configuration files in 2.0.5? It looks like you're not, because editing the "users" file *should* get it to work. It looks like you need to either: - set use_tunneled_reply = yes in eap.conf, peap{} sub-section - add the "set VLAN" configuration to the post-auth section. Alan DeKok.
I have modified eap.conf and added "use_tunneled_reply = yes" in the peap section. I have previously tried this, and obtained the same results. Whenever a client tries to login, they get cycled from authenticating/connecting very quickly. I've posted an example output from a radius debug: http://dpaste.com/112927/ Could you expand on the "set VLAN" option in the post-auth section? I have looked around a bit, but haven't found much of use. Also, I may try a vanilla install of FreeRADIUS, as I'm using the packaged version from the OpenBSD ports tree. There are a few config discrepancies, and I don't understand enough to know how they are having an effect. Thanks again, -William On Sun, Jan 25, 2009 at 12:03, Alan DeKok <aland@deployingradius.com> wrote:
William Graeber wrote:
Here is the output of a client associating immediately after the server starts: http://dpaste.com/112843/
You're not assigning the attributes that tell the server to put the user into a VLAN.
Are you using the *default* configuration files in 2.0.5? It looks like you're not, because editing the "users" file *should* get it to work.
It looks like you need to either:
- set use_tunneled_reply = yes in eap.conf, peap{} sub-section
- add the "set VLAN" configuration to the post-auth section.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I have modified eap.conf and added "use_tunneled_reply = yes" in the peap section. I have previously tried this, and obtained the same results. Whenever a client tries to login, they get cycled from authenticating/connecting very quickly. I've posted an example output from a radius debug: http://dpaste.com/112927/
You are getting an Access-Accept with VLAN attributes now: Sending Access-Accept of id 199 to 10.0.0.254 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "100" User-Name = "wgraeber" MS-MPPE-Recv-Key = 0x8d9a0e99e52c18b817039f9d503bbd00d66c3cf3927d2528460 7bb4c52ab58f1 MS-MPPE-Send-Key = 0x5b07ed87b3ddd6c9fe6186c9443d80cca1b7e24f393f854f585 59d26a1100bfb EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 But AP is unhappy. Do debug dot11 aaa and see what is it complaining about. It's missing something (probably Service-Type). Ivan Kalik Kalik Informatika ISP
Here is the output of Cisco debugging with "use_tunneled_reply = yes": http://dpaste.com/113022/ Again, I really appreciate your help. -William On Sun, Jan 25, 2009 at 18:29, <tnt@kalik.net> wrote:
I have modified eap.conf and added "use_tunneled_reply = yes" in the peap section. I have previously tried this, and obtained the same results. Whenever a client tries to login, they get cycled from authenticating/connecting very quickly. I've posted an example output from a radius debug: http://dpaste.com/112927/
You are getting an Access-Accept with VLAN attributes now:
Sending Access-Accept of id 199 to 10.0.0.254 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "100" User-Name = "wgraeber" MS-MPPE-Recv-Key = 0x8d9a0e99e52c18b817039f9d503bbd00d66c3cf3927d2528460 7bb4c52ab58f1 MS-MPPE-Send-Key = 0x5b07ed87b3ddd6c9fe6186c9443d80cca1b7e24f393f854f585 59d26a1100bfb EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000
But AP is unhappy. Do debug dot11 aaa and see what is it complaining about. It's missing something (probably Service-Type).
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I may have solved my own problem - I have contradicting encryption settings for each VLAN on the Cisco access point. I was testing the setup by bumping the user from VLAN 200 (WPA-required) to VLAN 100 (open access). I'll give this a shot and post my results. -William On Sun, Jan 25, 2009 at 22:14, William Graeber <swilly@swilly.tk> wrote:
Here is the output of Cisco debugging with "use_tunneled_reply = yes": http://dpaste.com/113022/
Again, I really appreciate your help.
-William
On Sun, Jan 25, 2009 at 18:29, <tnt@kalik.net> wrote:
I have modified eap.conf and added "use_tunneled_reply = yes" in the peap section. I have previously tried this, and obtained the same results. Whenever a client tries to login, they get cycled from authenticating/connecting very quickly. I've posted an example output from a radius debug: http://dpaste.com/112927/
You are getting an Access-Accept with VLAN attributes now:
Sending Access-Accept of id 199 to 10.0.0.254 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "100" User-Name = "wgraeber" MS-MPPE-Recv-Key = 0x8d9a0e99e52c18b817039f9d503bbd00d66c3cf3927d2528460 7bb4c52ab58f1 MS-MPPE-Send-Key = 0x5b07ed87b3ddd6c9fe6186c9443d80cca1b7e24f393f854f585 59d26a1100bfb EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000
But AP is unhappy. Do debug dot11 aaa and see what is it complaining about. It's missing something (probably Service-Type).
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- William M. Graeber Furman University PMB 27335 3300 Poinsett Highway Greenville, SC 29613 864 905 9533 (Mobile)
I have resolved the issue. I created a new VLAN with matching encryption settings to the default VLAN. Thank you all for helping! I have become much more familiar with the Cisco debugging procedure in the process. -William
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
tnt＠kalik.net -
William Graeber