Hi eveyrone, I am looking at the mac authentication ( https://wiki.freeradius.org/guide/mac-auth) Base on that article look that the main behavior is to authorise or not system base on their mac address in addition the EAP. Currently my setup is working well an can dynamically assign user/system vlan base on their authentification. However there's some equipement that won't be able to use EAP/PEAP authenticate over 802.1x, (smart tv for example). Most likely there's somehing I miss, but would that be something possible to assign vlan 199 to mac address ABCDEF and vlan 201 to mac address UVWXYZ -Luc -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster
Hi Luc MAC authentication using RADIUS has no way to set the VLAN. The attributes are only sent during EAP authentication Regards Max -----Original Message----- From: Freeradius-Users <freeradius-users-bounces+max.caines=wlv.ac.uk@lists.freeradius.org> On Behalf Of Luc Paulin Sent: 28 February 2019 14:51 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Mac authentication Hi eveyrone, I am looking at the mac authentication ( https://url6.mailanyone.net/v1/?m=1gzN2K-0001px-4B&i=57e1b682&c=7MV7zgTu9JII...) Base on that article look that the main behavior is to authorise or not system base on their mac address in addition the EAP. Currently my setup is working well an can dynamically assign user/system vlan base on their authentification. However there's some equipement that won't be able to use EAP/PEAP authenticate over 802.1x, (smart tv for example). Most likely there's somehing I miss, but would that be something possible to assign vlan 199 to mac address ABCDEF and vlan 201 to mac address UVWXYZ -Luc -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster - List info/subscribe/unsubscribe? See https://url6.mailanyone.net/v1/?m=1gzN2K-0001px-4B&i=57e1b682&c=hfnxPRhKjyUw... ------------------------------------ This email has been scanned for spam & viruses. If you believe this email should have been stopped by our filters, click the following link to report it (https://portal.mailanyone.net/index.html#/outer/reportspam?token=dXNlcj1tYXg...).
On Feb 28, 2019, at 10:09 AM, Caines, Max <Max.Caines@wlv.ac.uk> wrote:
MAC authentication using RADIUS has no way to set the VLAN. The attributes are only sent during EAP authentication
That's not true. VLAN assignment and authentication method are completely independent of each other. Alan DeKok.
So what would be the way of assigning vlan to mac address. I am sure there's something I miss/don't undertand but can't figure it out reading docs/forums. Would be appreciate if you could give me a hint.. Thanx! -Luc -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster Le jeu. 28 févr. 2019, à 11 h 08, Alan DeKok <aland@deployingradius.com> a écrit :
On Feb 28, 2019, at 10:09 AM, Caines, Max <Max.Caines@wlv.ac.uk> wrote:
MAC authentication using RADIUS has no way to set the VLAN. The attributes are only sent during EAP authentication
That's not true.
VLAN assignment and authentication method are completely independent of each other.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Feb 28, 2019, at 11:14 AM, Luc Paulin <paulinster@gmail.com> wrote:
So what would be the way of assigning vlan to mac address. I am sure there's something I miss/don't undertand but can't figure it out reading docs/forums. Would be appreciate if you could give me a hint.. Thanx!
Typically you read the NAS documentation to see what RADIUS attributes it needs in order to do VLAN assignment. Then, configure FreeRADIUS to send those attributes. Something like: update reply { Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := "VLAN ID OR VLAN NAME" } Alan DeKok.
Yes, I take your point. It was the specific case of MAC authentication for wireless on Cisco controllers I was thinking about. That involves a request with Service-Type set to "Call-Check", and the username set to the MAC address. It gets an Accept or Reject, and the controller will ignore any other attributes. In a more general context of course you're right Regards Max -----Original Message----- From: Freeradius-Users <freeradius-users-bounces+max.caines=wlv.ac.uk@lists.freeradius.org> On Behalf Of Alan DeKok Sent: 28 February 2019 16:08 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Mac authentication On Feb 28, 2019, at 10:09 AM, Caines, Max <Max.Caines@wlv.ac.uk> wrote:
MAC authentication using RADIUS has no way to set the VLAN. The attributes are only sent during EAP authentication
That's not true. VLAN assignment and authentication method are completely independent of each other. Alan DeKok. - List info/subscribe/unsubscribe? See https://url6.mailanyone.net/v1/?m=1gzOE2-0005DU-53&i=57e1b682&c=r5FX3MVsA9rm... ------------------------------------ This email has been scanned for spam & viruses. If you believe this email should have been stopped by our filters, click the following link to report it (https://portal.mailanyone.net/index.html#/outer/reportspam?token=dXNlcj1tYXg...).
Luc Paulin <paulinster@gmail.com> wrote:
Most likely there's somehing I miss, but would that be something possible to assign vlan 199 to mac address ABCDEF and vlan 201 to mac address UVWXYZ
Most NAS equipment these days will obey the standard attributes. You need to do an update on the reply packet to add them in a post-auth section. Since you are running dot1x as well you will have to do a: &Post-Auth-Type = MAB ...or something like that in the authorize section when you detect a mac-auth, Then in post-auth only those hosts will execute statements in a corresponding Post-Auth-Type subsection. (There might already be sensible values left in Post-Auth-Type by the default configuration and built-in module behavior.) Post-Auth-Type MAB { update reply { Tunnel-Type := "VLAN", Tunnel-Medium-Type := "IEEE-802", Tunnel-Private-Group-id := "1001" } } ...some NAS hardware will take locally defined VLAN names in Tunnel-Private-Group-Id , others will only take numbers, some with take either. The first two attributes should be left as is and are required by many NAS systems (per the standard.) NAS units will send the MAC address in an astounding variety of different formats. Some let you control the format with local settings, others may not be so flexible. Normalize it by defining some policies similar to this (look in the default configuration there may be some predefined.) policy { # this will match almost all formats I have seen without being overly liberal (if used with /i flag) mac-addr-regexp = '([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})' csid_into_control { if ("%{%{Calling-Station-Id}:-%{User-Name}}" =~ /^${policy.mac-addr-regexp}$/i) { update control { &Calling-Station-Id := "%{toupper:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}}" } } } } This normalizes the mac address into uppercase 5-colons form and puts that in the (unused) Calling-Station-Id attribute in the control attribute list, leaving the Calling-Station-Id in the request/reply attribute lists untouched. ...then in the above post-auth section, invoke that policy and compare the MAC address OUI to values you care about and add the VLAN attributes if it matches. csid_into_control if (&control:Calling-Station-Id =~ /^(AB:CD:EF|DE:AD:BE:EF)/) { update reply { # as above. } } ...you can also get fancier and retrive OUIs from a database or something but that's the basics.
participants (4)
-
Alan DeKok -
Brian Julin -
Caines, Max -
Luc Paulin