Hello, Does Freeradius 3.2.0 fully support MACSEC/dot1x? The only information I've found is that the following snippet in sites-available/default needs to be uncommented. Are there any additional RADIUS AV pairs I need to configure to make it work with Macsec/dot1x on Cisco devices? # MacSEC requires the use of EAP-Key-Name. However, we don't # want to send it for all EAP sessions. Therefore, the EAP # modules put required data into the EAP-Session-Id attribute. # This attribute is never put into a request or reply packet. # # Uncomment the next few lines to copy the required data into # the EAP-Key-Name attribute if (&reply:EAP-Session-Id) { update reply { EAP-Key-Name := &reply:EAP-Session-Id } } Thanks a lot.
On Aug 5, 2022, at 8:05 PM, Eric Nguyen <ericvunguyen@gmail.com> wrote:
Does Freeradius 3.2.0 fully support MACSEC/dot1x?
Yes. The server just needs to send back EAP-Key-Name with the correct information. The switch takes care of the rest.
The only information I've found is that the following snippet in sites-available/default needs to be uncommented. Are there any additional RADIUS AV pairs I need to configure to make it work with Macsec/dot1x on Cisco devices?
No. Alan DeKok.
Hi Alan Thanks a lot for the information. Best regards. On Sun, Aug 7, 2022 at 6:59 AM Alan DeKok <aland@deployingradius.com> wrote:
On Aug 5, 2022, at 8:05 PM, Eric Nguyen <ericvunguyen@gmail.com> wrote:
Does Freeradius 3.2.0 fully support MACSEC/dot1x?
Yes. The server just needs to send back EAP-Key-Name with the correct information. The switch takes care of the rest.
The only information I've found is that the following snippet in sites-available/default needs to be uncommented. Are there any additional RADIUS AV pairs I need to configure to make it work with Macsec/dot1x on Cisco devices?
No.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Eric Nguyen