Per Vendor NAS-Port documentation
Hi, I was wondering if there has been a collective effort to document the meaning of the NAS-Port by the various Network Vendors? We are working on PacketFence here (an open source NAC) and we translate the NAS-Port to the ifIndex so we can request a dot1x reauthentication to the ifIndex if we want to (ie: IDS event). We've done the translation by ourselves since vendor documentation is often lacking and I was thinking there must exist such a resource. Does anyone here know? I know we could use CoA with the original NAS-Port but it's less supported than the SNMP PAE Reauthenticate MIBs. Thanks! -- Olivier Bilodeau obilodeau@inverse.ca :: +1.514.447.4918 *115 :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)
Olivier Bilodeau wrote:
I was wondering if there has been a collective effort to document the meaning of the NAS-Port by the various Network Vendors?
Some, not much.
We are working on PacketFence here (an open source NAC) and we translate the NAS-Port to the ifIndex so we can request a dot1x reauthentication to the ifIndex if we want to (ie: IDS event).
That might work. Sometimes.
We've done the translation by ourselves since vendor documentation is often lacking and I was thinking there must exist such a resource. Does anyone here know?
If we have information, it's on the Wiki. Otherwise... it's hard. Most switch vendors do the Right Thing, and map NAS-Port to the switch port. For PPP, DSL, or WiFi systems, the NAS-Port is often meaningless.
I know we could use CoA with the original NAS-Port but it's less supported than the SNMP PAE Reauthenticate MIBs.
Yes. Alan DeKok.
Olivier Bilodeau wrote:
Hi,
I was wondering if there has been a collective effort to document the meaning of the NAS-Port by the various Network Vendors?
We are working on PacketFence here (an open source NAC) and we translate the NAS-Port to the ifIndex so we can request a dot1x reauthentication to the ifIndex if we want to (ie: IDS event).
We've done the translation by ourselves since vendor documentation is often lacking and I was thinking there must exist such a resource. Does anyone here know?
I know we could use CoA with the original NAS-Port but it's less supported than the SNMP PAE Reauthenticate MIBs.
Thanks! If there's nothing yet, maybe they can create a wiki page for it? I'd be willing to edit the entries, either on the wiki if I can get an account, or offline and batch up the responses into wiki markup.
I have Cisco on the wired side, Meru and BlueSocket on the wireless. I haven't done RADIUS on the wireless yet, but can try it out and check the values (probably meaningless) sometime. -Jason PS - I recently heard about PacketFence for the first time on a podcast (don't remember which one). Sounds like a very interesting and useful project.
I was wondering if there has been a collective effort to document the meaning of the NAS-Port by the various Network Vendors?
If there's nothing yet, maybe they can create a wiki page for it? I'd be willing to edit the entries, either on the wiki if I can get an account, or offline and batch up the responses into wiki markup.
As suggested, I created a Wiki page: http://wiki.freeradius.org/NAS-Port I added what we have so far. I'll try to remember to maintain it. Cheers! -- Olivier Bilodeau obilodeau@inverse.ca :: +1.514.447.4918 *115 :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)
Olivier Bilodeau wrote:
As suggested, I created a Wiki page: http://wiki.freeradius.org/NAS-Port
I added what we have so far. I'll try to remember to maintain it.
Thanks. Alan DeKok.
Olivier Bilodeau <obilodeau@inverse.ca> wrote:
If there's nothing yet, maybe they can create a wiki page for it? I'd be willing to edit the entries, either on the wiki if I can get an account, or offline and batch up the responses into wiki markup.
As suggested, I created a Wiki page: http://wiki.freeradius.org/NAS-Port
I added what we have so far. I'll try to remember to maintain it.
NAS-Port-Id not useful or am I missing something? I get 'FastEthernet1/0/2' and what not which is good enough for me. Obviously that is just what our Cisco 3750's knock out, and I guess other vendors might vary. Cheers -- Alexander Clouter .sigmonster says: "He don't know me vewy well, DO he?" -- Bugs Bunny
participants (4)
-
Alan DeKok -
Alexander Clouter -
Jason Antman -
Olivier Bilodeau