Hey guys I am a bit new to the scene and i am having a few problems with configuring freeradius. In essence what i want is that the user, once verified to be assigned to a specific vlan and get an ip address from a dhcp server, which will be aware of the vlans and there for assign different address and subnets to each. Does this scenario make any sense? Will it be the freeradius server that will be notifying the dhcp server to aquire an address for the client? Will the dhcp server then contact the access point to let it know what address the client has been given and it in its turn give it to the client? Or will it be that the access point will contact the dhcp server once it has the reply from the freeradius server, giving it the vlan id/number and requesting an ip address and other info? Is this the right or wrong way of going about this? regards George
On Thu, 2007-07-26 at 02:00 +0100, George Beitis wrote:
Hey guys I am a bit new to the scene and i am having a few problems with configuring freeradius. In essence what i want is that the user, once verified to be assigned to a specific vlan and get an ip address from a dhcp server, which will be aware of the vlans and there for assign different address and subnets to each. Does this scenario make any
yes
sense? Will it be the freeradius server that will be notifying the dhcp server to aquire an address for the client? Will the dhcp server then
No
contact the access point to let it know what address the client has been given and it in its turn give it to the client? Or will it be that the
No
access point will contact the dhcp server once it has the reply from the freeradius server, giving it the vlan id/number and requesting an ip address and other info?
No The way it works is: 1. Client does either 802.1x 2. Access point forwards authentication to radius server 3. Multiple 802.1x round-trips between client and radius server, via AP 4. When authentication is complete, the radius server returns an Access-Accept with the vlan tag 5. Access point reads the vlan tag, assigns it 6. Client brings up it's IP stack, and emits a DHCP DISCOVER 7. AP forwards the clients packet into the vlan at layer2 8. The vlan/subnet router forwards the DHCP DISCOVER to the DHCP server 9. DHCP server assigns an IP address based on source subnet & mac address There's no interaction between DHCP and Radius, no interaction between a layer2 access point and DHCP (possibly dhcp option-82 insertion), and no real interaction with a layer2 access point and any IP protocol. Basically - you just configure the AP with >1 vlan, configure a router for each VLAN with dhcp relay enabled, and configure the radius server to tell the AP the right vlan number. BEWARE: not all APs support vlan assignment.
Is this the right or wrong way of going about this?
regards George - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Dear Phil Firstly thank you for taking the time to reply and for your straight forward reply to this matter. I 'm doing this as part of my MSc project, well this is actually part of the initial setup, not the project it self, and i have in my disposal a limited number of devices. I borrowed a cisco aeronet 1200 access point from my department, which supports vlans and i also have a linksys router (wrt54gl) (which i will use as a switch) and i have an old computer with one ethernet card which i intend to install freeradius on and a dhcp server. From there on i might add some more devices each belonging to a different vlan. My thinking from what you said is to setup the vlans/tunnels on the access point, setup freeradius and then run a dhcp server on the old computer. If i want to add the dhcp server to many virtual lans do i need to create some sort of virtual interface for each? Or does the router need to be aware of where to forward dhcp packets coming from different vlans? thank you for your help regards George Phil Mayers wrote:
On Thu, 2007-07-26 at 02:00 +0100, George Beitis wrote:
Hey guys I am a bit new to the scene and i am having a few problems with configuring freeradius. In essence what i want is that the user, once verified to be assigned to a specific vlan and get an ip address from a dhcp server, which will be aware of the vlans and there for assign different address and subnets to each. Does this scenario make any
yes
sense? Will it be the freeradius server that will be notifying the dhcp server to aquire an address for the client? Will the dhcp server then
No
contact the access point to let it know what address the client has been given and it in its turn give it to the client? Or will it be that the
No
access point will contact the dhcp server once it has the reply from the freeradius server, giving it the vlan id/number and requesting an ip address and other info?
No
The way it works is:
1. Client does either 802.1x 2. Access point forwards authentication to radius server 3. Multiple 802.1x round-trips between client and radius server, via AP 4. When authentication is complete, the radius server returns an Access-Accept with the vlan tag 5. Access point reads the vlan tag, assigns it 6. Client brings up it's IP stack, and emits a DHCP DISCOVER 7. AP forwards the clients packet into the vlan at layer2 8. The vlan/subnet router forwards the DHCP DISCOVER to the DHCP server 9. DHCP server assigns an IP address based on source subnet & mac address
There's no interaction between DHCP and Radius, no interaction between a layer2 access point and DHCP (possibly dhcp option-82 insertion), and no real interaction with a layer2 access point and any IP protocol.
Basically - you just configure the AP with >1 vlan, configure a router for each VLAN with dhcp relay enabled, and configure the radius server to tell the AP the right vlan number.
BEWARE: not all APs support vlan assignment.
Is this the right or wrong way of going about this?
regards George - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Do you have to use an external DHCP server (project requirement)? Aironet has one (Cisco IOS). You can define DHCP pools on the AP and pass avpair for the pool with your vlan configuration from Freeradius. You can also do away withDHCP, define ip_pools in Freeradius and pass addresses, DNS etc. with vlan configuration directly from radius. Ivan Kalik Kalik Informatika ISP Dana 26/7/2007, "George Beitis" <george.beitis@gmail.com> piše:
Dear Phil Firstly thank you for taking the time to reply and for your straight forward reply to this matter. I 'm doing this as part of my MSc project, well this is actually part of the initial setup, not the project it self, and i have in my disposal a limited number of devices. I borrowed a cisco aeronet 1200 access point from my department, which supports vlans and i also have a linksys router (wrt54gl) (which i will use as a switch) and i have an old computer with one ethernet card which i intend to install freeradius on and a dhcp server. From there on i might add some more devices each belonging to a different vlan.
My thinking from what you said is to setup the vlans/tunnels on the access point, setup freeradius and then run a dhcp server on the old computer. If i want to add the dhcp server to many virtual lans do i need to create some sort of virtual interface for each? Or does the router need to be aware of where to forward dhcp packets coming from different vlans?
thank you for your help
regards George
Phil Mayers wrote:
On Thu, 2007-07-26 at 02:00 +0100, George Beitis wrote:
Hey guys I am a bit new to the scene and i am having a few problems with configuring freeradius. In essence what i want is that the user, once verified to be assigned to a specific vlan and get an ip address from a dhcp server, which will be aware of the vlans and there for assign different address and subnets to each. Does this scenario make any
yes
sense? Will it be the freeradius server that will be notifying the dhcp server to aquire an address for the client? Will the dhcp server then
No
contact the access point to let it know what address the client has been given and it in its turn give it to the client? Or will it be that the
No
access point will contact the dhcp server once it has the reply from the freeradius server, giving it the vlan id/number and requesting an ip address and other info?
No
The way it works is:
1. Client does either 802.1x 2. Access point forwards authentication to radius server 3. Multiple 802.1x round-trips between client and radius server, via AP 4. When authentication is complete, the radius server returns an Access-Accept with the vlan tag 5. Access point reads the vlan tag, assigns it 6. Client brings up it's IP stack, and emits a DHCP DISCOVER 7. AP forwards the clients packet into the vlan at layer2 8. The vlan/subnet router forwards the DHCP DISCOVER to the DHCP server 9. DHCP server assigns an IP address based on source subnet & mac address
There's no interaction between DHCP and Radius, no interaction between a layer2 access point and DHCP (possibly dhcp option-82 insertion), and no real interaction with a layer2 access point and any IP protocol.
Basically - you just configure the AP with >1 vlan, configure a router for each VLAN with dhcp relay enabled, and configure the radius server to tell the AP the right vlan number.
BEWARE: not all APs support vlan assignment.
Is this the right or wrong way of going about this?
regards George - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/usershtml
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hey Ivan no i dont have to use an external one, but it seems like the only choice as the Aironet 1200 access point does not come with one bundled it, which would have made my life easier, but on the other hand it wouldn't be extensible or simulate a real life case thanks for your reply regards George tnt@kalik.co.yu wrote:
Do you have to use an external DHCP server (project requirement)? Aironet has one (Cisco IOS). You can define DHCP pools on the AP and pass avpair for the pool with your vlan configuration from Freeradius. You can also do away withDHCP, define ip_pools in Freeradius and pass addresses, DNS etc. with vlan configuration directly from radius.
Ivan Kalik Kalik Informatika ISP
Dana 26/7/2007, "George Beitis" <george.beitis@gmail.com> piše:
Dear Phil Firstly thank you for taking the time to reply and for your straight forward reply to this matter. I 'm doing this as part of my MSc project, well this is actually part of the initial setup, not the project it self, and i have in my disposal a limited number of devices. I borrowed a cisco aeronet 1200 access point from my department, which supports vlans and i also have a linksys router (wrt54gl) (which i will use as a switch) and i have an old computer with one ethernet card which i intend to install freeradius on and a dhcp server. From there on i might add some more devices each belonging to a different vlan.
My thinking from what you said is to setup the vlans/tunnels on the access point, setup freeradius and then run a dhcp server on the old computer. If i want to add the dhcp server to many virtual lans do i need to create some sort of virtual interface for each? Or does the router need to be aware of where to forward dhcp packets coming from different vlans?
thank you for your help
regards George
Phil Mayers wrote:
On Thu, 2007-07-26 at 02:00 +0100, George Beitis wrote:
Hey guys I am a bit new to the scene and i am having a few problems with configuring freeradius. In essence what i want is that the user, once verified to be assigned to a specific vlan and get an ip address from a dhcp server, which will be aware of the vlans and there for assign different address and subnets to each. Does this scenario make any
yes
sense? Will it be the freeradius server that will be notifying the dhcp server to aquire an address for the client? Will the dhcp server then
No
contact the access point to let it know what address the client has been given and it in its turn give it to the client? Or will it be that the
No
access point will contact the dhcp server once it has the reply from the freeradius server, giving it the vlan id/number and requesting an ip address and other info?
No
The way it works is:
1. Client does either 802.1x 2. Access point forwards authentication to radius server 3. Multiple 802.1x round-trips between client and radius server, via AP 4. When authentication is complete, the radius server returns an Access-Accept with the vlan tag 5. Access point reads the vlan tag, assigns it 6. Client brings up it's IP stack, and emits a DHCP DISCOVER 7. AP forwards the clients packet into the vlan at layer2 8. The vlan/subnet router forwards the DHCP DISCOVER to the DHCP server 9. DHCP server assigns an IP address based on source subnet & mac address
There's no interaction between DHCP and Radius, no interaction between a layer2 access point and DHCP (possibly dhcp option-82 insertion), and no real interaction with a layer2 access point and any IP protocol.
Basically - you just configure the AP with >1 vlan, configure a router for each VLAN with dhcp relay enabled, and configure the radius server to tell the AP the right vlan number.
BEWARE: not all APs support vlan assignment.
Is this the right or wrong way of going about this?
regards George - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/usershtml
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Are you sure? Type: ip dhcp pool whatever(pool name) in configuration mode and you should go into dhcp pool configuration. You should be able to configure IP range (network), gateway (derfault-router) and DNS (dns-server) from there. I am sure dhcp is included in IOS. Ivan Kalik Kalik Informatika ISP Dana 26/7/2007, "George Beitis" <george.beitis@gmail.com> piše:
Hey Ivan no i dont have to use an external one, but it seems like the only choice as the Aironet 1200 access point does not come with one bundled it, which would have made my life easier, but on the other hand it wouldn't be extensible or simulate a real life case
thanks for your reply regards George
tnt@kalik.co.yu wrote:
Do you have to use an external DHCP server (project requirement)? Aironet has one (Cisco IOS). You can define DHCP pools on the AP and pass avpair for the pool with your vlan configuration from Freeradius. You can also do away withDHCP, define ip_pools in Freeradius and pass addresses, DNS etc. with vlan configuration directly from radius.
Ivan Kalik Kalik Informatika ISP
Dana 26/7/2007, "George Beitis" <george.beitis@gmail.com> piše:
Dear Phil Firstly thank you for taking the time to reply and for your straight forward reply to this matter. I 'm doing this as part of my MSc project, well this is actually part of the initial setup, not the project it self, and i have in my disposal a limited number of devices. I borrowed a cisco aeronet 1200 access point from my department, which supports vlans and i also have a linksys router (wrt54gl) (which i will use as a switch) and i have an old computer with one ethernet card which i intend to install freeradius on and a dhcp server. From there on i might add some more devices each belonging to a different vlan.
My thinking from what you said is to setup the vlans/tunnels on the access point, setup freeradius and then run a dhcp server on the old computer. If i want to add the dhcp server to many virtual lans do i need to create some sort of virtual interface for each? Or does the router need to be aware of where to forward dhcp packets coming from different vlans?
thank you for your help
regards George
Phil Mayers wrote:
On Thu, 2007-07-26 at 02:00 +0100, George Beitis wrote:
Hey guys I am a bit new to the scene and i am having a few problems with configuring freeradius. In essence what i want is that the user, once verified to be assigned to a specific vlan and get an ip address from a dhcp server, which will be aware of the vlans and there for assign different address and subnets to each. Does this scenario make any
yes
sense? Will it be the freeradius server that will be notifying the dhcp server to aquire an address for the client? Will the dhcp server then
No
contact the access point to let it know what address the client has been given and it in its turn give it to the client? Or will it be that the
No
access point will contact the dhcp server once it has the reply from the freeradius server, giving it the vlan id/number and requesting an ip address and other info?
No
The way it works is:
1. Client does either 802.1x 2. Access point forwards authentication to radius server 3. Multiple 802.1x round-trips between client and radius server, via AP 4. When authentication is complete, the radius server returns an Access-Accept with the vlan tag 5. Access point reads the vlan tag, assigns it 6. Client brings up it's IP stack, and emits a DHCP DISCOVER 7. AP forwards the clients packet into the vlan at layer2 8. The vlan/subnet router forwards the DHCP DISCOVER to the DHCP server 9. DHCP server assigns an IP address based on source subnet & mac address
There's no interaction between DHCP and Radius, no interaction between a layer2 access point and DHCP (possibly dhcp option-82 insertion), and no real interaction with a layer2 access point and any IP protocol.
Basically - you just configure the AP with >1 vlan, configure a router for each VLAN with dhcp relay enabled, and configure the radius server to tell the AP the right vlan number.
BEWARE: not all APs support vlan assignment.
Is this the right or wrong way of going about this?
regards George - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/usershtml
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/usershtml
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Thu, 2007-07-26 at 14:09 +0100, tnt@kalik.co.yu wrote:
Are you sure? Type:
ip dhcp pool whatever(pool name)
in configuration mode and you should go into dhcp pool configuration. You should be able to configure IP range (network), gateway (derfault-router) and DNS (dns-server) from there. I am sure dhcp is included in IOS.
Sure, in IOS for routers. Does the IOS on the APs do routing? I've never tried it.
In access points it does not do any routing from what i can tell so far Phil Mayers wrote:
On Thu, 2007-07-26 at 14:09 +0100, tnt@kalik.co.yu wrote:
Are you sure? Type:
ip dhcp pool whatever(pool name)
in configuration mode and you should go into dhcp pool configuration. You should be able to configure IP range (network), gateway (derfault-router) and DNS (dns-server) from there. I am sure dhcp is included in IOS.
Sure, in IOS for routers. Does the IOS on the APs do routing? I've never tried it.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
PS. In real life case you would send your dynamic vlan configuration with IP addresses etc. from radius and keep your authentication, accounting and IP administration in one place. That scales best. Ivan Kalik Kalik Informatika ISP Dana 26/7/2007, "George Beitis" <george.beitis@gmail.com> piše:
Hey Ivan no i dont have to use an external one, but it seems like the only choice as the Aironet 1200 access point does not come with one bundled it, which would have made my life easier, but on the other hand it wouldn't be extensible or simulate a real life case
thanks for your reply regards George
tnt@kalik.co.yu wrote:
Do you have to use an external DHCP server (project requirement)? Aironet has one (Cisco IOS). You can define DHCP pools on the AP and pass avpair for the pool with your vlan configuration from Freeradius. You can also do away withDHCP, define ip_pools in Freeradius and pass addresses, DNS etc. with vlan configuration directly from radius.
Ivan Kalik Kalik Informatika ISP
Dana 26/7/2007, "George Beitis" <george.beitis@gmail.com> piše:
Dear Phil Firstly thank you for taking the time to reply and for your straight forward reply to this matter. I 'm doing this as part of my MSc project, well this is actually part of the initial setup, not the project it self, and i have in my disposal a limited number of devices. I borrowed a cisco aeronet 1200 access point from my department, which supports vlans and i also have a linksys router (wrt54gl) (which i will use as a switch) and i have an old computer with one ethernet card which i intend to install freeradius on and a dhcp server. From there on i might add some more devices each belonging to a different vlan.
My thinking from what you said is to setup the vlans/tunnels on the access point, setup freeradius and then run a dhcp server on the old computer. If i want to add the dhcp server to many virtual lans do i need to create some sort of virtual interface for each? Or does the router need to be aware of where to forward dhcp packets coming from different vlans?
thank you for your help
regards George
Phil Mayers wrote:
On Thu, 2007-07-26 at 02:00 +0100, George Beitis wrote:
Hey guys I am a bit new to the scene and i am having a few problems with configuring freeradius. In essence what i want is that the user, once verified to be assigned to a specific vlan and get an ip address from a dhcp server, which will be aware of the vlans and there for assign different address and subnets to each. Does this scenario make any
yes
sense? Will it be the freeradius server that will be notifying the dhcp server to aquire an address for the client? Will the dhcp server then
No
contact the access point to let it know what address the client has been given and it in its turn give it to the client? Or will it be that the
No
access point will contact the dhcp server once it has the reply from the freeradius server, giving it the vlan id/number and requesting an ip address and other info?
No
The way it works is:
1. Client does either 802.1x 2. Access point forwards authentication to radius server 3. Multiple 802.1x round-trips between client and radius server, via AP 4. When authentication is complete, the radius server returns an Access-Accept with the vlan tag 5. Access point reads the vlan tag, assigns it 6. Client brings up it's IP stack, and emits a DHCP DISCOVER 7. AP forwards the clients packet into the vlan at layer2 8. The vlan/subnet router forwards the DHCP DISCOVER to the DHCP server 9. DHCP server assigns an IP address based on source subnet & mac address
There's no interaction between DHCP and Radius, no interaction between a layer2 access point and DHCP (possibly dhcp option-82 insertion), and no real interaction with a layer2 access point and any IP protocol.
Basically - you just configure the AP with >1 vlan, configure a router for each VLAN with dhcp relay enabled, and configure the radius server to tell the AP the right vlan number.
BEWARE: not all APs support vlan assignment.
Is this the right or wrong way of going about this?
regards George - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/usershtml
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/usershtml
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Thu, 2007-07-26 at 13:11 +0100, tnt@kalik.co.yu wrote:
Do you have to use an external DHCP server (project requirement)? Aironet has one (Cisco IOS). You can define DHCP pools on the AP and pass avpair for the pool with your vlan configuration from Freeradius. You can also do away withDHCP, define ip_pools in Freeradius and pass addresses, DNS etc. with vlan configuration directly from radius.
Are you certain this works? What would the config look like?
My thinking from what you said is to setup the vlans/tunnels on the access point, setup freeradius and then run a dhcp server on the old computer. If i want to add the dhcp server to many virtual lans do i need to create some sort of virtual interface for each? Or does the router need to be aware of where to forward dhcp packets coming from different vlans?
Yes. If you're running linux, you can create them manually: vconfig set_name_type DEV_PLUS_VID vconfig add eth0 10 ifconfig eth0.10 up ifconfig eth0.10 address 10.10.0.1 255.255.255.0 ...better yet, most Linux distributions have vlan-aware init scripts e.g. on Fedora/Redhat: echo "VLAN=yes" >>/etc/sysconfig/network cat >>/etc/sysconfig/network-scripts/ifcfg-eth0.10 <<EOF DEVICE=eth0.10 IPADDR=10.10.0.1 NETMASK=255.255.255.0 EOF # Don't forget you need to enable IP forwarding e.g. sysctl -w net.ipv4.ip_forward=1 # ...or maybe edit /etc/sysctl.conf I suggest you look at the docs for the networking setup on your OS.
participants (3)
-
George Beitis -
Phil Mayers -
tnt＠kalik.co.yu