freeradius auto-vlan 3com switch 4500G
HI, Has anyone successfully implemented auto-vlan with 3Com switch 4500G? I am using the following tunneling attributes: ATTRIBUTE Tunnel-Type 64 integer has_tag ATTRIBUTE Tunnel-Medium-Type 65 integer has_tag ATTRIBUTE Tunnel-Private-Group-Id 81 string has_tag VALUE Tunnel-Type VLAN 13 VALUE Tunnel-Medium-Type TMT802 6 The node is declared as followed: ##IT Dell Inspiron 4000 laptop -- DHCP 00-09-5b-61-52-0d Auth-Type := Local, User-Password == "00-09-5b-61-52-0d" Tunnel-Medium-Type = TMT802, Tunnel-Private-Group-id = 2, Tunnel-Type = VLAN, Although my radius access request shows that the access has been granted and the VLAN 2 assigned, the switch 4500G does not open its port on VLAN 2. I changed the tunnel-medium-type between TMT802 and 802, but that did not change anything. I am currently doing auto-vlan with 3com 4400 with the same configuration and it is working like a charm. Any idea why the switch does automatically adjust? Any beginning of information is welcome. Thanks, Philippe _RADIUS ACCESS_REQUEST LOG_ rad_recv: Access-Request packet from host 172.20.181.201:1024, id=41, length=126 User-Name = "00-09-5b-61-52-0d" User-Password = "00-09-5b-61-52-0d" NAS-IP-Address = 172.20.181.201 NAS-Identifier = "4500G" NAS-Port = 16809985 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0009-5b61-520d" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "00-09-5b-61-52-0d", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry 00-09-5b-61-52-0d at line 2 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [00-09-5b-61-52-0d] (from client switch201 port 16809985 cli 0009-5b61-520d) Sending Access-Accept of id 41 to 172.20.181.201 port 1024 Tunnel-Medium-Type:0 = TMT802 Tunnel-Private-Group-Id:0 = "2u" Tunnel-Type:0 = VLAN Finished request 0
VLAN 2u not 2 has been assigned. Check node entry. Ivan Kalik Kalik Informatika ISP Dana 9/11/2007, "Philippe Breton" <pbreton@wustl.edu> piše:
HI,
Has anyone successfully implemented auto-vlan with 3Com switch 4500G?
I am using the following tunneling attributes:
ATTRIBUTE Tunnel-Type 64 integer has_tag ATTRIBUTE Tunnel-Medium-Type 65 integer has_tag ATTRIBUTE Tunnel-Private-Group-Id 81 string has_tag VALUE Tunnel-Type VLAN 13 VALUE Tunnel-Medium-Type TMT802 6
The node is declared as followed:
##IT Dell Inspiron 4000 laptop -- DHCP 00-09-5b-61-52-0d Auth-Type := Local, User-Password == "00-09-5b-61-52-0d" Tunnel-Medium-Type = TMT802, Tunnel-Private-Group-id = 2, Tunnel-Type = VLAN,
Although my radius access request shows that the access has been granted and the VLAN 2 assigned, the switch 4500G does not open its port on VLAN 2.
I changed the tunnel-medium-type between TMT802 and 802, but that did not change anything.
I am currently doing auto-vlan with 3com 4400 with the same configuration and it is working like a charm. Any idea why the switch does automatically adjust?
Any beginning of information is welcome.
Thanks,
Philippe
_RADIUS ACCESS_REQUEST LOG_ rad_recv: Access-Request packet from host 172.20.181.201:1024, id=41, length=126 User-Name = "00-09-5b-61-52-0d" User-Password = "00-09-5b-61-52-0d" NAS-IP-Address = 172.20.181.201 NAS-Identifier = "4500G" NAS-Port = 16809985 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0009-5b61-520d" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "00-09-5b-61-52-0d", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry 00-09-5b-61-52-0d at line 2 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [00-09-5b-61-52-0d] (from client switch201 port 16809985 cli 0009-5b61-520d) Sending Access-Accept of id 41 to 172.20.181.201 port 1024 Tunnel-Medium-Type:0 = TMT802 Tunnel-Private-Group-Id:0 = "2u" Tunnel-Type:0 = VLAN Finished request 0
On Fri, 2007-11-09 at 21:58 +0100, tnt@kalik.co.yu wrote:
VLAN 2u not 2 has been assigned. Check node entry.
Ivan. Thanks. I have corected it, but no luck yet. Someone else has suggested to use a different tunnel-medium-type: Tunnel-Medium-Type = IEEE-802. I checking this lead now. Thanks, Philippe
Ivan Kalik Kalik Informatika ISP
Dana 9/11/2007, "Philippe Breton" <pbreton@wustl.edu> piše:
HI,
Has anyone successfully implemented auto-vlan with 3Com switch 4500G?
I am using the following tunneling attributes:
ATTRIBUTE Tunnel-Type 64 integer has_tag ATTRIBUTE Tunnel-Medium-Type 65 integer has_tag ATTRIBUTE Tunnel-Private-Group-Id 81 string has_tag VALUE Tunnel-Type VLAN 13 VALUE Tunnel-Medium-Type TMT802 6
The node is declared as followed:
##IT Dell Inspiron 4000 laptop -- DHCP 00-09-5b-61-52-0d Auth-Type := Local, User-Password == "00-09-5b-61-52-0d" Tunnel-Medium-Type = TMT802, Tunnel-Private-Group-id = 2, Tunnel-Type = VLAN,
Although my radius access request shows that the access has been granted and the VLAN 2 assigned, the switch 4500G does not open its port on VLAN 2.
I changed the tunnel-medium-type between TMT802 and 802, but that did not change anything.
I am currently doing auto-vlan with 3com 4400 with the same configuration and it is working like a charm. Any idea why the switch does automatically adjust?
Any beginning of information is welcome.
Thanks,
Philippe
_RADIUS ACCESS_REQUEST LOG_ rad_recv: Access-Request packet from host 172.20.181.201:1024, id=41, length=126 User-Name = "00-09-5b-61-52-0d" User-Password = "00-09-5b-61-52-0d" NAS-IP-Address = 172.20.181.201 NAS-Identifier = "4500G" NAS-Port = 16809985 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0009-5b61-520d" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "00-09-5b-61-52-0d", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry 00-09-5b-61-52-0d at line 2 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [00-09-5b-61-52-0d] (from client switch201 port 16809985 cli 0009-5b61-520d) Sending Access-Accept of id 41 to 172.20.181.201 port 1024 Tunnel-Medium-Type:0 = TMT802 Tunnel-Private-Group-Id:0 = "2u" Tunnel-Type:0 = VLAN Finished request 0
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 2007-11-09 20:52, Philippe Breton wrote:
HI, Hi,
Has anyone successfully implemented auto-vlan with 3Com switch 4500G? Successfully implemented with 5500G :)
I am using the following tunneling attributes:
ATTRIBUTE Tunnel-Type 64 integer has_tag ATTRIBUTE Tunnel-Medium-Type 65 integer has_tag ATTRIBUTE Tunnel-Private-Group-Id 81 string has_tag VALUE Tunnel-Type VLAN 13 VALUE Tunnel-Medium-Type TMT802 6
No need to. Freeradius comes with very decent dictionary.
The node is declared as followed:
##IT Dell Inspiron 4000 laptop -- DHCP 00-09-5b-61-52-0d Auth-Type := Local, User-Password == "00-09-5b-61-52-0d" Tunnel-Medium-Type = TMT802, Tunnel-Private-Group-id = 2, Tunnel-Type = VLAN,
Tunnel-Medium-Type = IEEE-802
Although my radius access request shows that the access has been granted and the VLAN 2 assigned, the switch 4500G does not open its port on VLAN 2.
I changed the tunnel-medium-type between TMT802 and 802, but that did not change anything.
I am currently doing auto-vlan with 3com 4400 with the same configuration and it is working like a charm. Any idea why the switch does automatically adjust?
4400 and 4500G models have completely different hardware and software.
Any beginning of information is welcome.
Did you setup your switch properly: domain (...) vlan-assignment-mode string
Tunnel-Private-Group-Id:0 = "2u"
AFAIK "u" tagging does not work with this model. Drop it. Best regards, Krzysztof Olędzki
Krzysztof what attributes are you using? Krzysztof Olędzki wrote:
On 2007-11-09 20:52, Philippe Breton wrote:
HI, Hi,
Has anyone successfully implemented auto-vlan with 3Com switch 4500G? Successfully implemented with 5500G :)
I am using the following tunneling attributes:
ATTRIBUTE Tunnel-Type 64 integer has_tag ATTRIBUTE Tunnel-Medium-Type 65 integer has_tag ATTRIBUTE Tunnel-Private-Group-Id 81 string has_tag VALUE Tunnel-Type VLAN 13 VALUE Tunnel-Medium-Type TMT802 6
No need to. Freeradius comes with very decent dictionary.
The node is declared as followed:
##IT Dell Inspiron 4000 laptop -- DHCP 00-09-5b-61-52-0d Auth-Type := Local, User-Password == "00-09-5b-61-52-0d" Tunnel-Medium-Type = TMT802, Tunnel-Private-Group-id = 2, Tunnel-Type = VLAN,
Tunnel-Medium-Type = IEEE-802
I did this correction but not to avail!
Although my radius access request shows that the access has been granted and the VLAN 2 assigned, the switch 4500G does not open its port on VLAN 2.
I changed the tunnel-medium-type between TMT802 and 802, but that did not change anything.
I am currently doing auto-vlan with 3com 4400 with the same configuration and it is working like a charm. Any idea why the switch does automatically adjust?
4400 and 4500G models have completely different hardware and software.
Have I had realized those differences I would have had spend an extra $200 for the 3870!
Any beginning of information is welcome.
Did you setup your switch properly:
domain (...) vlan-assignment-mode string
Hard to give a 100% answer on this question. I believe I did with the help of 3com support.
Tunnel-Private-Group-Id:0 = "2u"
AFAIK "u" tagging does not work with this model. Drop it.
I did! But that too did not change anything
Best regards,
Krzysztof Olędzki
-- Philippe Breton Systems Manager Dpt. of Molecular Biology & Pharmacology Washington University School of Medicine 314-747-2968 (office) 314-419-2124 (pager) pbreton@wustl.edu
On 2007-11-11 15:03, Phil Mayers wrote:
Have I had realized those differences I would have had spend an extra $200 for the 3870!
offtopic but: DO NOT buy the 3870. They're disastrous.
I second that. There are even not able to report a proper port number in a radius request for RADA. Best regards, Krzysztof Olędzki
On 2007-11-10 17:30, Philippe Breton wrote:
Did you setup your switch properly:
domain (...) vlan-assignment-mode string
Hard to give a 100% answer on this question. I believe I did with the help of 3com support.
This is the most important part. Please make sure it is set up (display current-configuration). Best regards, Krzysztof Olędzki
On Sun, 2007-11-11 at 17:37 +0100, Krzysztof Olędzki wrote:
On 2007-11-10 17:30, Philippe Breton wrote:
Did you setup your switch properly:
domain (...) vlan-assignment-mode string
Hard to give a 100% answer on this question. I believe I did with the help of 3com support.
This is the most important part. Please make sure it is set up (display current-configuration).
... I agree with you. The 4500G is new to me. I believe I got it right. One important fact to keep in mind is the semantic is a litle different between the 5500g and 4500G, i.e. what's in this doc does not apply in the 4500G http://www.3com.hu/download/switch_radius_setup.doc/switch_radius_setup.doc This is my current config: (Thanks for you comments about the 3870. What do you use?) ============================================================================= 4500G]display current-configuration # sysname 4500G # info-center source 8021X channel 0 info-center source MACAUTH channel 0 info-center source VLAN channel 0 undo info-center source default channel 0 info-center source default channel 1 log level debugging info-center source MACAUTH channel 9 log level debugging info-center loghost source Vlan-interface1 info-center loghost 172.20.181.220 facility local1 # domain default enable system # local-server nas-ip 127.0.0.1 key 3com # telnet server enable # undo cluster enable # MAC-authentication MAC-authentication domain wustl.edu # igmp-snooping # vlan 1 description VLAN172 igmp-snooping enable # vlan 2 description VLAN181 # radius scheme system server-type extended primary authentication 127.0.0.1 1645 primary accounting 127.0.0.1 1646 user-name-format without-domain radius scheme radius1 server-type standard primary authentication 192.168.181.18 key authentication sdfsdfsfsf user-name-format without-domain # domain system access-limit disable state active idle-cut disable self-service-url disable domain wustl.edu authentication default radius-scheme radius1 access-limit disable state active idle-cut disable self-service-url disable # local-user admin service-type telnet terminal level 3 local-user manager password simple manager service-type telnet terminal level 2 local-user monitor password simple monitor service-type telnet terminal level 1 # interface NULL0 # interface Vlan-interface1 ip address 172.20.181.201 255.255.255.0 # interface GigabitEthernet1/0/1 port link-type hybrid port hybrid vlan 1 to 2 tagged broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/2 port access vlan 2 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/3 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/4 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/5 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/6 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/7 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/8 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable MAC-authentication # interface GigabitEthernet1/0/9 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/10 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/11 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/12 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/13 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/14 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/15 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/16 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/17 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/18 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/19 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/20 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/21 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/22 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/23 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/24 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/25 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/26 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/27 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/28 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/29 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/30 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/31 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/32 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/33 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/34 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/35 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/36 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/37 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/38 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/39 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/40 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/41 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/42 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/43 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/44 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/45 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/46 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/47 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/48 broadcast-suppression pps 3000 undo jumboframe enable stp edged-port enable # interface GigabitEthernet1/0/49 broadcast-suppression pps 3000 undo jumboframe enable shutdown stp edged-port enable # interface GigabitEthernet1/0/50 broadcast-suppression pps 3000 undo jumboframe enable shutdown stp edged-port enable # interface GigabitEthernet1/0/51 broadcast-suppression pps 3000 undo jumboframe enable shutdown stp edged-port enable # interface GigabitEthernet1/0/52 broadcast-suppression pps 3000 undo jumboframe enable shutdown stp edged-port enable # ip route-static 0.0.0.0 0.0.0.0 172.20.181.254 # snmp-agent snmp-agent local-engineid 8000002B03001AC1A234C1 snmp-agent community read public snmp-agent community write private snmp-agent sys-info version all # user-interface aux 0 authentication-mode scheme user-interface vty 0 4 authentication-mode scheme # return [4500G]
Best regards,
Krzysztof Olędzki
On 2007-11-11 18:27, Philippe Breton wrote:
On Sun, 2007-11-11 at 17:37 +0100, Krzysztof Olędzki wrote:
On 2007-11-10 17:30, Philippe Breton wrote:
Did you setup your switch properly:
domain (...) vlan-assignment-mode string Hard to give a 100% answer on this question. I believe I did with the help of 3com support. This is the most important part. Please make sure it is set up (display current-configuration).
... I agree with you. The 4500G is new to me. I believe I got it right. One important fact to keep in mind is the semantic is a litle different between the 5500g and 4500G, i.e. what's in this doc does not apply in the 4500G http://www.3com.hu/download/switch_radius_setup.doc/switch_radius_setup.doc
This is my current config:
Please excuse me for the long delay. A day should be longer than 24h. ;)
description VLAN181 # radius scheme system server-type extended primary authentication 127.0.0.1 1645 primary accounting 127.0.0.1 1646 user-name-format without-domain
radius scheme radius1 server-type standard primary authentication 192.168.181.18 key authentication sdfsdfsfsf user-name-format without-domain # domain system access-limit disable state active idle-cut disable self-service-url disable
domain wustl.edu authentication default radius-scheme radius1 access-limit disable state active idle-cut disable self-service-url disable
Please add here: vlan-assignment-mode string accounting optional It is required for 3c5500G, so it should also solve the problem on 3c4500G. If not, please enable radius/mac-authentication/port-security debugging on the switch. Best regards, Krzysztof Olędzki -- Krzysztof Olędzki Axel Springer Polska Sp. z o.o. tel: +48-22-2320969 fax: +48-22-2325530
participants (4)
-
Krzysztof Olędzki -
Phil Mayers -
Philippe Breton -
tnt＠kalik.co.yu