Need help with Freeradius and 802.1X
I have searched the forum but can't find what I'm looking for. Here is my scenario: Users with Vista machines and the 802.1X supplicant configured Windows Server 2008 with Active Directory Other network connected devices and 'unknown' computers 100% Cisco LAN/WAN Here is what I want to do: Dynamic VLAN assignment based on 802.1X with Freeradius able to use Active Directory for the computers with the supplicant configured and also be able to use MySQL to do MAC authentication bypass for known devices like printers that can't use a supplicant. I don't have much experience with Freeradius but I feel this is something that would be a "normal" 802.1X configuration. Any help on how to configure this environment would be greatly appreciated. Thanks, John -- View this message in context: http://freeradius.1045715.n5.nabble.com/Need-help-with-Freeradius-and-802-1X... Sent from the FreeRadius - User mailing list archive at Nabble.com.
johnboy68 wrote:
Users with Vista machines and the 802.1X supplicant configured Windows Server 2008 with Active Directory Other network connected devices and 'unknown' computers 100% Cisco LAN/WAN
Here is what I want to do:
Dynamic VLAN assignment based on 802.1X with Freeradius able to use Active Directory for the computers with the supplicant configured and also be able to use MySQL to do MAC authentication bypass for known devices like printers that can't use a supplicant.
It takes care, but it's not hard. Step 1, configure AD authentication. See my web page: http://deployingradius.com Step 2, configure MAC address authentication. See the Wiki. The key thing is... do each step in isolation. Don't worry about changes in Step 1 breaking step 2. Make sure you understand each piece in isolation before you try to combine them. Once you get that far come back with more questions.
I don't have much experience with Freeradius but I feel this is something that would be a "normal" 802.1X configuration.
Pretty much, yes. Alan DeKok.
I have ntlm_auth working. I can auth my AD users with this command: radtest -t mschap aduser aspassword localhost 0 testing123 And it works. My problem is when I configure one of my Cisco switches to do 802.1x and authenticate with Freeradius my Windows (Windows 7 and Vista) machines fail to get authorized with the Windows supplicant. I am running Freeradius in debug mode and have tried to trace down where it is failing on my own but since I have no experience in this area I am just chasing my tail. Is it a problem with PEAP, EAP, TLS? Do I need a certificate? I just don't know and if I did I wouldn't know how to configure it. I have not been able to find any conclusive documentation in this area. I could put the output here of what Freeradius outputs during a connection attempt but I since I am testing this in our production environment, I don't want to put that kind of information out in a public forum. Any thoughts? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Need-help-with-Freeradius-and-802-1X... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi,
I have ntlm_auth working. I can auth my AD users with this command:
radtest -t mschap aduser aspassword localhost 0 testing123
And it works.
My problem is when I configure one of my Cisco switches to do 802.1x and authenticate with Freeradius my Windows (Windows 7 and Vista) machines fail to get authorized with the Windows supplicant. I am running Freeradius in debug mode and have tried to trace down where it is failing on my own but since I have no experience in this area I am just chasing my tail. Is it a problem with PEAP, EAP, TLS? Do I need a certificate? I just don't know and if I did I wouldn't know how to configure it. I have not been able to find any conclusive documentation in this area.
the windows clients need the CA for your RADIUS server installed in their certificate store alan
johnboy68 wrote:
I have ntlm_auth working. I can auth my AD users with this command:
radtest -t mschap aduser aspassword localhost 0 testing123
And it works.
Good!
My problem is when I configure one of my Cisco switches to do 802.1x and authenticate with Freeradius my Windows (Windows 7 and Vista) machines fail to get authorized with the Windows supplicant. I am running Freeradius in debug mode and have tried to trace down where it is failing on my own but since I have no experience in this area I am just chasing my tail. Is it a problem with PEAP, EAP, TLS? Do I need a certificate? I just don't know and if I did I wouldn't know how to configure it. I have not been able to find any conclusive documentation in this area.
The Wiki describes this. See the "Certificate Compatibility" page. See also my AD integration guide: http://deployingradius.com. That should be pointed to from the Wiki, too. That guide contains *detailed* instructions for what to do. The only time it hasn't worked for people is when they didn't follow its instructions.
I could put the output here of what Freeradius outputs during a connection attempt but I since I am testing this in our production environment, I don't want to put that kind of information out in a public forum.
Run it in debug mode and read the output. What does it say? What warnings / errors does it produce? Alan DeKok.
participants (3)
-
Alan Buxey -
Alan DeKok -
johnboy68