Hi, Trying to find out whether any HP products support PoD (Packet of Disconnect). I've got a HP2626 ProCurve switch and one of the new HP 530 WAPs (released last august). Tried using radclient with the example in the wiki, but I don't get any response back from the switch or the WAP. According to the RFC (rfc3576) even if the packet of disconnect does not have the correct attributes , the NAS should send back a PoD NAK with the appropriate error code. The lack of Disconnect NAK suggests that HP devices don't support PoD, but I just wanted to check to see if anybody has had any experience with this. Seems strange that their enterprise products don't support something as basic as this, specially when the RFC was published in 2003. *sigh* Whats even more stupid is that you can disconnect users using the ssh interface on the switches using, # conf *# aaa port-access authenticator <port range> reauthenticate* .
Arran Cudbard-Bell wrote:
Hi,
Trying to find out whether any HP products support PoD (Packet of Disconnect). I've got a HP2626 ProCurve switch and one of the new HP 530 WAPs (released last august).
If you don't have a reason to believe they *do* i.e. docs saying so, they almost certainly don't.
Seems strange that their enterprise products don't support something as basic as this, specially when the RFC was published in 2003.
It's annoying but it's not strange. A lot of vendors don't even bother with full and complete radius auth/acct support - why go for PoD? For wired switches, you might try setting the ifMauAutoNegRestart (described in RFC 2668) to "1" which on quite a few switches will drop the physical link and as a byproduct cause authentication to restart (which, if you've now banned this person, is a good thing). This has the dual advantage that it causes windows boxes to re-lease their IPs by DHCP, which is valuable if you've moved them into a walled garden network.
Phil Mayers wrote:
Arran Cudbard-Bell wrote:
Hi,
Trying to find out whether any HP products support PoD (Packet of Disconnect). I've got a HP2626 ProCurve switch and one of the new HP 530 WAPs (released last august).
If you don't have a reason to believe they *do* i.e. docs saying so, they almost certainly don't.
Ah yes but in HPs manuals no where do they mention the relevant attributes to do *anything*. So I was holding on to a faint glimmer of hope...
Seems strange that their enterprise products don't support something as basic as this, specially when the RFC was published in 2003.
It's annoying but it's not strange. A lot of vendors don't even bother with full and complete radius auth/acct support - why go for PoD?
Because they're damn expensive, but yes I don't think i've found one device which fully complies with the relevant RFC specs *sigh*.
For wired switches, you might try setting the ifMauAutoNegRestart (described in RFC 2668) to "1" which on quite a few switches will drop the physical link and as a byproduct cause authentication to restart (which, if you've now banned this person, is a good thing).
Forces link speed renegotiation ? . Guess i'll have to look through the mibs for the wireless APs and see if they have anything similar. Thanks for the pointer with SNMP :) -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
participants (2)
-
Arran Cudbard-Bell -
Phil Mayers