Hi, I'm seting up a FreeRadius Server using SQL backend to store informations about NAS, Users and Groups. I search the Attribute to use to allow a group in a VLAN of my switch. My setup permit to authenticate a user and the group of the user. But what is the attribute to use in table radreply or radgroupreply to put the port of my switch in the good vlan ? Best regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group
You have to send some attributes to the switch. I am using Cisco switches and here are the attributes that I need to send to the switch to switch the port to VLAN 3: bob Cleartext-Password := "test" Tunnel-Type:0 = VLAN, Tunnel-Medium-Type:0 = IEEE-802, Tunnel-Private-Group-Id:0 = "3", Tunnel-Preference = 0x000000 Other switch vendor may use different attributes. I add these attributes in the "users" file. I am not using SQL. Don't know how to pull the attributes via sql... Hope it helps, Difan Zhao M.Eng Network Engineer difan.zhao@guest-tek.com www.guest-tek.com Office: 403-509-1010 ext 3048 Cell: 403-689-7514 -----Original Message----- From: freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradius.org [mailto:freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradi us.org] On Behalf Of Fabien COMBERNOUS Sent: Tuesday, April 20, 2010 9:06 AM To: freeradius-users@lists.freeradius.org Subject: VLAN Attribute ? Hi, I'm seting up a FreeRadius Server using SQL backend to store informations about NAS, Users and Groups. I search the Attribute to use to allow a group in a VLAN of my switch. My setup permit to authenticate a user and the group of the user. But what is the attribute to use in table radreply or radgroupreply to put the port of my switch in the good vlan ? Best regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Difan Zhao wrote:
You have to send some attributes to the switch. I am using Cisco switches and here are the attributes that I need to send to the switch to switch the port to VLAN 3:
bob Cleartext-Password := "test" Tunnel-Type:0 = VLAN, Tunnel-Medium-Type:0 = IEEE-802, Tunnel-Private-Group-Id:0 = "3", Tunnel-Preference = 0x000000
Other switch vendor may use different attributes. Thank you for your input.
I'm using HP procurve core switch. I used the following values : Tunnel-Type = 13 Tunnel-Medium-Type = 6 Tunnel-Private-Group-ID =4 It works. In radius log i get the display you given. ie VLAN instead of 13, IEEE-802 instead of 6. I will make some tests to use directly your input. It is easier to read. But i am surprise. In the rfc the value 13 does not exist about Tunnel-Type : http://freeradius.org/rfc/rfc2868.html#Tunnel-Type Where is decided the value of 13 ? Best regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group
Actually I found these attributes from Cisco switch configuration manual and I just pasted them in and they worked... However I just did a search again and I found the attribute is in this dictionary file: dictionary.rfc3580:VALUE Tunnel-Type VLAN 13 BTW I also got a question for you. It has a ":0" following the "Tunnel-Type". What is it for? I just removed it and it still works. However in the Radius -X debug it still has the :0 appending the attribute name. Any idea?? Thanks, Difan Zhao M.Eng Network Engineer difan.zhao@guest-tek.com www.guest-tek.com Office: 403-509-1010 ext 3048 Cell: 403-689-7514 -----Original Message----- From: freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradius.org [mailto:freeradius-users-bounces+difan.zhao=guest-tek.com@lists.freeradi us.org] On Behalf Of Fabien COMBERNOUS Sent: Wednesday, April 21, 2010 3:12 AM To: FreeRadius users mailing list Subject: Re: VLAN Attribute ? Difan Zhao wrote:
You have to send some attributes to the switch. I am using Cisco switches and here are the attributes that I need to send to the switch to switch the port to VLAN 3:
bob Cleartext-Password := "test" Tunnel-Type:0 = VLAN, Tunnel-Medium-Type:0 = IEEE-802, Tunnel-Private-Group-Id:0 = "3", Tunnel-Preference = 0x000000
Other switch vendor may use different attributes. Thank you for your input.
I'm using HP procurve core switch. I used the following values : Tunnel-Type = 13 Tunnel-Medium-Type = 6 Tunnel-Private-Group-ID =4 It works. In radius log i get the display you given. ie VLAN instead of 13, IEEE-802 instead of 6. I will make some tests to use directly your input. It is easier to read. But i am surprise. In the rfc the value 13 does not exist about Tunnel-Type : http://freeradius.org/rfc/rfc2868.html#Tunnel-Type Where is decided the value of 13 ? Best regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Difan Zhao wrote:
BTW I also got a question for you. It has a ":0" following the "Tunnel-Type". What is it for? I just removed it and it still works. However in the Radius -X debug it still has the :0 appending the attribute name. Any idea??
It's a tag. You can define up to 31 Tunnel-Type attributes in a packet for various purposes. For all practical uses: it's always zero. Alan DeKok.
participants (3)
-
Alan DeKok -
Difan Zhao -
Fabien COMBERNOUS