Assigning users into different VLANs
Hi, I am using FreeRADIUS together with WLC from Cisco. I have 1 WLAN connected to 2 VLANs and I need to assign user into VLAN based on successful pass AAA or not. By that I mean to separate guests and members. How can I achieve that? For now I am using "users" as source of members. I came up wtih this "admin" Cleartext-Password := "admin" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 52, Tunnel-Preference = 0x000000 to assign member into VLAN 52 but I strugle with assigning VLAN for user without certificate or password (I need two variants based on certificate and PEAP, two different servers). Thank you for any advice. -- Martin
Hi,
I am using FreeRADIUS together with WLC from Cisco. I have 1 WLAN connected to 2 VLANs and I need to assign user into VLAN based on successful pass AAA or not. By that I mean to separate guests and members. How can I achieve that? For now I am using "users" as source of members. I came up wtih this "admin" Cleartext-Password := "admin" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 52, Tunnel-Preference = 0x000000 to assign member into VLAN 52 but I strugle with assigning VLAN for user without certificate or password (I need two variants based on certificate and PEAP, two different servers).
well, using the RADIUS attributes, which you have done, is the way to do it. how you do it with your users is down to your policies. you'll probably end up using unlang in the post-auth phase (man unlang) however, if this is an EAP/802.1X wireless network you cant do much if they fail. alan
I read man unlang but to be honest I din't find it really useful for me. However in "users" I found that DEFAULT or Fall-Through could be used if I have no entry for username. What I need to do is autetificate everyone. I have couple of users as user "admin" and for that users I creat entries like this one: "admin" Cleartext-Password := "admin" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 53, Tunnel-Preference = 0x000000 Then all other users I need to place into VLAN 54. So at the end of file I thought entry like this could be ok to pass absolutely everyone: "DEFAULT" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Fall-Through = Yes, #tried with/without Tunnel-Private-Group-Id = 54, Tunnel-Preference = 0x000000 But this and all others I tried didn't work. Wireless network is [WPA/TKIP + WPA2/AES][Auth(802.1X)]. Have you any dvice how to fix it? 2014-07-02 10:11 GMT+02:00 <A.L.M.Buxey@lboro.ac.uk>:
Hi,
I am using FreeRADIUS together with WLC from Cisco. I have 1 WLAN connected to 2 VLANs and I need to assign user into VLAN based on successful pass AAA or not. By that I mean to separate guests and members. How can I achieve that? For now I am using "users" as source of members. I came up wtih this "admin" Cleartext-Password := "admin" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 52, Tunnel-Preference = 0x000000 to assign member into VLAN 52 but I strugle with assigning VLAN for user without certificate or password (I need two variants based on certificate and PEAP, two different servers).
well, using the RADIUS attributes, which you have done, is the way to do it. how you do it with your users is down to your policies. you'll probably end up using unlang in the post-auth phase (man unlang)
however, if this is an EAP/802.1X wireless network you cant do much if they fail.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Martin Hrabovský 5ZP031
Hi,
"admin" Cleartext-Password := "admin" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 53, Tunnel-Preference = 0x000000 Then all other users I need to place into VLAN 54. So at the end of file I thought entry like this could be ok to pass absolutely everyone: "DEFAULT" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Fall-Through = Yes, #tried with/without Tunnel-Private-Group-Id = 54, Tunnel-Preference = 0x000000
Fall-Through not needed....if you needed it you put it right at the end alan
Yes, I tried it without it as well, but it didn't work eather. Do I need to change something in other file? (Logging as admin works well.) 2014-07-09 12:51 GMT+02:00 <A.L.M.Buxey@lboro.ac.uk>:
Hi,
"admin" Cleartext-Password := "admin" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 53, Tunnel-Preference = 0x000000 Then all other users I need to place into VLAN 54. So at the end of file I thought entry like this could be ok to pass absolutely everyone: "DEFAULT" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Fall-Through = Yes, #tried with/without Tunnel-Private-Group-Id = 54, Tunnel-Preference = 0x000000
Fall-Through not needed....if you needed it you put it right at the end
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Martin Hrabovský 5ZP031
Hi, Shall I lunch debug mode by "radius - X" and then try to connect? Will try it next day and show what goes out. 2014-07-09 13:27 GMT+02:00 <A.L.M.Buxey@lboro.ac.uk>:
Hi,
Yes, I tried it without it as well, but it didn't work eather. Do I need to change something in other file? (Logging as admin works well.)
what does full debug mode show?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Martin Hrabovský 5ZP031
Here is what I catched in debug mode. While users file: "DEFAULT" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 52, Tunnel-Preference = 0x000000 "mhx" Cleartext-Password := "admin" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 53, Tunnel-Preference = 0x000000 DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP 2014-07-09 13:27 GMT+02:00 <A.L.M.Buxey@lboro.ac.uk>:
Hi,
Yes, I tried it without it as well, but it didn't work eather. Do I need to change something in other file? (Logging as admin works well.)
what does full debug mode show?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Martin Hrabovský 5ZP031
On 10-07-14 11:35, Martin Hrabovský wrote:
Here is what I catched in debug mode.
While users file: "mhx" Cleartext-Password := "admin" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 53, Tunnel-Preference = 0x000000
"mhx" is the only user with a password. According to the debug log, you're trying to authenticate with user "admin". It cannot find an entry in the users file, which causes it to reject. -- Herwin Weststrate
That's it! I need to log in even if I don' know user name nor password. According documentation I should use DEFAULT. "A cpecial user named "DEFAULT" matches on all usernames." - this is stated in "users" file. And why I want use "DEFAULT"? To move everyone who has no entry in users file (so in this case everyone except mhx) into VLAN 52. Is it possible to achieve this with FreeRADIUS? 2014-07-10 12:04 GMT+02:00 Herwin Weststrate <herwin@quarantainenet.nl>:
On 10-07-14 11:35, Martin Hrabovský wrote:
Here is what I catched in debug mode.
While users file: "mhx" Cleartext-Password := "admin" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 53, Tunnel-Preference = 0x000000
"mhx" is the only user with a password. According to the debug log, you're trying to authenticate with user "admin". It cannot find an entry in the users file, which causes it to reject.
-- Herwin Weststrate - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Martin Hrabovský 5ZP031
On 10-07-14 12:18, Martin Hrabovský wrote:
That's it! I need to log in even if I don' know user name nor password.
According documentation I should use DEFAULT. "A cpecial user named "DEFAULT" matches on all usernames." - this is stated in "users" file.
And why I want use "DEFAULT"? To move everyone who has no entry in users file (so in this case everyone except mhx) into VLAN 52.
Then you need some more logic in the authorize section. The user does match (line 749 of Debug: [files] users: Matched entry DEFAULT at line 6), but then all the authentication types require a password before the user can be authenticated (see lines 762-767). You need a bit more logic in the inner-tunnel virtual server. Writing from memory, change the first line of the user DEFAULT to: "DEFAULT" Auth-Type := Accept A few more things you want to consider: - Remove the "files" statement from authorize in sites-enabled/default, this may overwrite the reply with the VLAN attributes for the outer username. - Put the DEFAULT user at the end of the file. Otherwise, the user mhx will also match DEFAULT and get the Auth-Type Accept. -- Herwin Weststrate
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Herwin Weststrate -
Martin Hrabovský