provide DAC and NAC to one host
hi list here is an example of one of my client.conf and the virtual-server ------------------------nas----------------------- client devices { ipaddr = 192.168.1.1 proto = * secret = testing123 require_message_authenticator = no nas-type = other limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } virtual_server = devicemanager } ----------------------------virtual server---------------------- server devicemanager { authorize { Use_Auth_Ladp filter_username disabled devicemanager_check ldap pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix exec attr_filter.accounting_response } session { } post-auth { exec remove_reply_message_if_eap Post-Auth-Type REJECT { attr_filter.access_reject eap remove_reply_message_if_eap } } pre-proxy { } post-proxy { eap } } ----------------------------------end----------------------- Host 192.168.1.1 is a switch, as i have configed radius device access for host 192.168.1.1, what am i suppose to do if i am want to enable switch port dot1x (network access control)on this swtich with the same radius server,
Hi,
what am i suppose to do if i am want to enable switch port dot1x (network access control)on this swtich with the same radius server,
read the manual/doc for your switch to ensure that you configure the 802.1X environment on the switch and set relevant required port configuration correctly. alan
Hi Buxey here is my policy for the SW 192.168.1.1 devicemanager_check { if (Ldap-Group == "DeviceManager") { update { &control:User-Profile ="cn=DeviceManager,ou=Admin,ou=Group,dc=gd,dc=quantum-info,dc=com" } } elsif (Ldap-Group == "Device_Write") { update reply { &control:User-Profile ="cn=Device_Write,ou=Admin,ou=Group,dc=gd,dc=quantum-info,dc=com" } updated } elsif (Ldap-Group == "Device_Review") { update { &control:User-Profile ="cn=Device_Review,ou=Admin,ou=Group,dc=gd,dc=quantum-info,dc=com" } updated } else { update reply { &Reply-Message += "%{User-Name},you are not authorized to access , please confirm that you have the permission..." } reject } } you can see that , when SW sent radius request , it always applied to this Policy check and reject if the user is not the member of the speacific group. what i mean to proivde DAC and NAC to one host is how to make freeradius server to applied to two different policys base on what request type it receive. On 03/21/2016 05:57 PM, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
what am i suppose to do if i am want to enable switch port dot1x (network access control)on this swtich with the same radius server, read the manual/doc for your switch to ensure that you configure the 802.1X environment on the switch and set relevant required port configuration correctly.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
A.L.M.Buxey＠lboro.ac.uk -
MichaelLeung