testing dynamic VLANs (RADIUS-assigned)
Hi, I'm trying to test a basic VLAN setup. For now I just need to assign a test user's host to a specific VLAN. For simplicity's sake, in the default authorize section (sites-enabled) I am calling a custom policy "filter_username" function which includes the following test clause: if (&User-Name == "tstusr") { update reply { Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := 12 } accept } I see this in the log: (0) Login OK: [tstusr] (from client D1881 port 15 cli F4-39-09-D9-14-C8)(0) Sent Access-Accept Id 16 from 10.215.144.91:1812 to 10.215.144.146:33288 length 0 (0) Tunnel-Type := VLAN (0) Tunnel-Medium-Type := IEEE-802 (0) Tunnel-Private-Group-Id := "12" (0) Finished request However, the host I'm connecting doesn't seem to be able to communicate with other hosts in VLAN 12. How can I debug this further? Thanks, Vieri
On Mar 15, 2019, at 10:56 AM, Vieri via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I see this in the log:
(0) Login OK: [tstusr] (from client D1881 port 15 cli F4-39-09-D9-14-C8)(0) Sent Access-Accept Id 16 from 10.215.144.91:1812 to 10.215.144.146:33288 length 0 (0) Tunnel-Type := VLAN (0) Tunnel-Medium-Type := IEEE-802 (0) Tunnel-Private-Group-Id := "12" (0) Finished request
However, the host I'm connecting doesn't seem to be able to communicate with other hosts in VLAN 12.
How can I debug this further?
Ask the NAS why it's ignoring the VLAN assignment. Alan DeKok.
On Friday, March 15, 2019, 4:13:19 PM GMT+1, Alan DeKok <aland@deployingradius.com> wrote:
Ask the NAS why it's ignoring the VLAN assignment. The NAS says: EAP message not received from server. RADIUS server did not send required EAP message.
I'll have to review my FR config. Vieri
On Mar 15, 2019, at 12:21 PM, Vieri via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:nment.
The NAS says: EAP message not received from server. RADIUS server did not send required EAP message.
I'll have to review my FR config.
Uh... you can't just force an accept with EAP. You *must* run the full EAP conversation. Fix your configuration to *add* the VLAN information to the reply. Remove the part that forces "accept". Alan DeKok.
participants (2)
-
Alan DeKok -
Vieri