mac authentication based on ssid
Hello All, I have one more question. I would like to do mac authentication only when the request is coming from a certain ssid, otherwise straight on to eap. Could someone tell me how to do that? Thanks again, Bertalan Voros
Bertalan, This is going to depend upon your controller setup. Assuming Cisco for this discussion. What I did is set up a virtual server on a different port and pointed my controller to look at that virtual instance of radius. Look at the documentation on virtual servers. http://freeradius.org/features/virtual_servers.html It still allows you to run a single-ish instance of radius but allows you to separate/isolate the logic depending on SSID. - JohnD On 10/18/2013 11:48 AM, Bertalan Voros wrote:
Hello All,
I have one more question.
I would like to do mac authentication only when the request is coming from a certain ssid, otherwise straight on to eap.
Could someone tell me how to do that?
Thanks again, Bertalan Voros
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I was thinking along the lines of if (Called-Station-ID := "Some regex ssid") { rewrite_calling_station_id authorized_macs if (!OK) { reject } } Is this a possible/sensible approach? Still need to work out the regex bit. On 18 October 2013 16:48, Bertalan Voros <bertalan.voros@gmail.com> wrote:
Hello All,
I have one more question.
I would like to do mac authentication only when the request is coming from a certain ssid, otherwise straight on to eap.
Could someone tell me how to do that?
Thanks again, Bertalan Voros
-- Bertalan Voros m: 07932858025
That methods is possible if you kit sends an attribute you can use for this purpose. Look at debug logs. .. eg if(%{Called-Station-Id} ~= /:ssid$/) { blah blah } alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.
Hi Alan, The AP I am testing with does send the ssid name with the request, hopefully the new APs will too. If not it could this be achieved by matching the mac of the APs? This is what I came up with after finally figuring out what unlang meant. ;-] Is this also correct? Your code looks more elegant though, just curious if this would also work. if (Called-Station-ID =~ /^(.*?(\bssid\b)[^$]*)$/i) { rewrite_calling_station_id authorized_macs if (!OK) { reject } } Unfortunately I will only be able to test this on Monday. Thanks a lot and have a great weekend, Bertalan On 18 October 2013 18:12, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
That methods is possible if you kit sends an attribute you can use for this purpose. Look at debug logs. .. eg
if(%{Called-Station-Id} ~= /:ssid$/) { blah blah }
alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.
-- Bertalan Voros m: 07932858025
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Some kit sends the SSID in a separate VSA. If yours does you can also use that. .. you may end up having to do both methods of you have mixed vendors etc. But it's your infrastructure? Your wireless kit let's you use a different RADIUS config for each SSID? If so, use a different port and then you can have a different virtual server config. Also, thinking of speed/optimisations is there any need for expensive case insensitive regex? alan - -- Sent from my Android device with K-9 Mail. Please excuse my brevity. -----BEGIN PGP SIGNATURE----- Version: APG v1.0.9 iHkEAREIADkFAlJiV+0yHEFsYW4gQnV4ZXkgKEFsYW4gQnV4ZXkpIDxhLmwubS5i dXhleUBsYm9yby5hYy51az4ACgkQobRdvRSkLC4m6QCfbto5cFEyGrF8naKfcjKI JMSga7oAnjRmeVSCFO9aSzCHuK5nXvCgWq1F =GiOc -----END PGP SIGNATURE-----
Hi Alan, You are right, on both regex and using a virtual server. Your much simpler regex does the job, if the new APs do not give out the ssid in a usable way, I will use virtual servers. I don't do this often enough to get good enaough. Thanks again, Bertalan On 19 October 2013 10:59, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Hi
Some kit sends the SSID in a separate VSA. If yours does you can also use that. .. you may end up having to do both methods of you have mixed vendors etc. But it's your infrastructure? Your wireless kit let's you use a different RADIUS config for each SSID? If so, use a different port and then you can have a different virtual server config. Also, thinking of speed/optimisations is there any need for expensive case insensitive regex?
alan - -- Sent from my Android device with K-9 Mail. Please excuse my brevity. -----BEGIN PGP SIGNATURE----- Version: APG v1.0.9
iHkEAREIADkFAlJiV+0yHEFsYW4gQnV4ZXkgKEFsYW4gQnV4ZXkpIDxhLmwubS5i dXhleUBsYm9yby5hYy51az4ACgkQobRdvRSkLC4m6QCfbto5cFEyGrF8naKfcjKI JMSga7oAnjRmeVSCFO9aSzCHuK5nXvCgWq1F =GiOc -----END PGP SIGNATURE-----
-- Bertalan Voros m: 07932858025
participants (3)
-
Alan Buxey -
Bertalan Voros -
John Douglass