Setting VLAN from inner-tunnel
Hi I am trying to assign a VLAN for PEAP and TTLS clients using a section like this in the inner-tunnel configuration:- update outer.reply { Tunnel-Private-Group-ID := 123 Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 } However, I can't get it to work. The attributes are added and in the debug I can see that they go to the NAS in the access-challenge sections but they are not present in the final access-accept. Is there any way to make this work? Thanks -- Ben Thompson
Is there any way to make this work?
I have it working with: update reply { Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = 141 } Regards, Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.
On Mon, Mar 29, 2010 at 01:02:09PM +0100, Leighton Man wrote:
Is there any way to make this work?
I have it working with:
update reply { Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = 141 }
Thanks, but unless I'm missing somthing I don't understand how this can this work from the inner tunnel without "update outer.reply" ?
Thanks, but unless I'm missing somthing I don't understand how this can this work from the inner tunnel without "update outer.reply" ?
Sorry, it's almost a year since I got this going. I didn't really *understand* how it worked then (and I still don't, though I'm learning!) but the config I sent is a straight copy from my sites-available/inner-tunnel and I see the relevant reply items being sent. Sorry I can't be more help. Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.
On 03/29/2010 02:25 PM, Ben Thompson wrote:
On Mon, Mar 29, 2010 at 01:02:09PM +0100, Leighton Man wrote:
Is there any way to make this work?
I have it working with:
update reply { Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = 141 }
Thanks, but unless I'm missing somthing I don't understand how this can this work from the inner tunnel without "update outer.reply" ?
See: eap { ttls { use_tunneled_reply = yes } } ...which saves the AVPs in the tunneled Access-Accept, and copies them to the final outer Access-Accept.
participants (4)
-
Alan DeKok -
Ben Thompson -
Leighton Man -
Phil Mayers