Dynamic VLAN-id setting on wireless AP
Hi, I want to tag VLANs on the wireless AP (Mikrotik OS) according to radius criteria (type of autentization, DN in certificate etc.). Does someone here have experience with that? It seems easy enough to do on the freeradius side, but how is this supposed to work on the wireless AP side? (I know, this is not a Mikrotik mailing list, sorry in advance :). Does the AP really have to be smart enough to tag packets per-client? Should it work out of the box? Is it secure to mix clients from different security domains? Any experience appreciated, thanks -- Jan Schermer Linux Administrator ET NETERA | smart e-business solutions jan.schermer@etnetera.cz +420 608022225 ~ [ www.ahold.cz | www.annonce.cz | www.datart.cz ] [ www.knizniweb.cz | www.siemens.cz | www.cz.o2.com ] Created by ET NETERA | Powered by jNetPublish
/interface vlan > crete VLAN names, IDs and bind to phisical interface /ip address > assign IP subnets to VLAN interfaces (names) VLANS can only enhance security. Ivan Kalik Kalik Informatika ISP Dana 30/5/2007, "Jan Schermer / ET NETERA" <jan.schermer@etnetera.cz> piše:
Hi, I want to tag VLANs on the wireless AP (Mikrotik OS) according to radius criteria (type of autentization, DN in certificate etc.). Does someone here have experience with that? It seems easy enough to do on the freeradius side, but how is this supposed to work on the wireless AP side? (I know, this is not a Mikrotik mailing list, sorry in advance :). Does the AP really have to be smart enough to tag packets per-client? Should it work out of the box? Is it secure to mix clients from different security domains?
Any experience appreciated, thanks
-- Jan Schermer Linux Administrator ET NETERA | smart e-business solutions jan.schermer@etnetera.cz +420 608022225 ~ [ www.ahold.cz | www.annonce.cz | www.datart.cz ] [ www.knizniweb.cz | www.siemens.cz | www.cz.o2.com ]
Created by ET NETERA | Powered by jNetPublish
Do you use this scenario? Does Mikrotik really restrict each user to the given VLAN? Thanks Jan Schermer Linux Administrator ET NETERA | smart e-business solutions jan.schermer@etnetera.cz +420 608022225 ~ [ www.ahold.cz | www.annonce.cz | www.datart.cz ] [ www.knizniweb.cz | www.siemens.cz | www.cz.o2.com ] Created by ET NETERA | Powered by jNetPublish tnt@kalik.co.yu wrote:
/interface vlan > crete VLAN names, IDs and bind to phisical interface /ip address > assign IP subnets to VLAN interfaces (names)
VLANS can only enhance security.
Ivan Kalik Kalik Informatika ISP
Dana 30/5/2007, "Jan Schermer / ET NETERA" <jan.schermer@etnetera.cz> piše:
Hi, I want to tag VLANs on the wireless AP (Mikrotik OS) according to radius criteria (type of autentization, DN in certificate etc.). Does someone here have experience with that? It seems easy enough to do on the freeradius side, but how is this supposed to work on the wireless AP side? (I know, this is not a Mikrotik mailing list, sorry in advance :). Does the AP really have to be smart enough to tag packets per-client? Should it work out of the box? Is it secure to mix clients from different security domains?
Any experience appreciated, thanks
-- Jan Schermer Linux Administrator ET NETERA | smart e-business solutions jan.schermer@etnetera.cz +420 608022225 ~ [ www.ahold.cz | www.annonce.cz | www.datart.cz ] [ www.knizniweb.cz | www.siemens.cz | www.cz.o2.com ]
Created by ET NETERA | Powered by jNetPublish
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Restricts as much as the static VLAN can. No, our wireless clients have to use VPN(PPTP) if they want Internet mail etc. Local traffic (game servers etc.) is left wild with only bandwidth restrictions. Ivan Kalik Kalik Informatika ISP Dana 30/5/2007, "Jan Schermer / ET NETERA" <jan.schermer@etnetera.cz> piše:
Do you use this scenario? Does Mikrotik really restrict each user to the given VLAN?
Thanks
Jan Schermer Linux Administrator ET NETERA | smart e-business solutions jan.schermer@etnetera.cz +420 608022225 ~ [ www.ahold.cz | www.annonce.cz | www.datart.cz ] [ www.knizniweb.cz | www.siemens.cz | www.cz.o2.com ]
Created by ET NETERA | Powered by jNetPublish
tnt@kalik.co.yu wrote:
/interface vlan > crete VLAN names, IDs and bind to phisical interface /ip address > assign IP subnets to VLAN interfaces (names)
VLANS can only enhance security.
Ivan Kalik Kalik Informatika ISP
Dana 30/5/2007, "Jan Schermer / ET NETERA" <jan.schermer@etnetera.cz> piše:
Hi, I want to tag VLANs on the wireless AP (Mikrotik OS) according to radius criteria (type of autentization, DN in certificate etc.). Does someone here have experience with that? It seems easy enough to do on the freeradius side, but how is this supposed to work on the wireless AP side? (I know, this is not a Mikrotik mailing list, sorry in advance :). Does the AP really have to be smart enough to tag packets per-client? Should it work out of the box? Is it secure to mix clients from different security domains?
Any experience appreciated, thanks
-- Jan Schermer Linux Administrator ET NETERA | smart e-business solutions jan.schermer@etnetera.cz +420 608022225 ~ [ www.ahold.cz | www.annonce.cz | www.datart.cz ] [ www.knizniweb.cz | www.siemens.cz | www.cz.o2.com ]
Created by ET NETERA | Powered by jNetPublish
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jan Schermer / ET NETERA wrote:
Hi, I want to tag VLANs on the wireless AP (Mikrotik OS) according to radius criteria (type of autentization, DN in certificate etc.). Does someone here have experience with that? It seems easy enough to do on the freeradius side, but how is this supposed to work on the wireless AP side? (I know, this is not a Mikrotik mailing list, sorry in advance :). Does the AP really have to be smart enough to tag packets per-client? Should it work out of the box? Is it secure to mix clients from different security domains?
Any experience appreciated, thanks
I'm pretty sure the RouterOS stuff isn't smart enough to do Dynamic VLAN assignment... If it is, it will want Tunnel-Type → Type of tunnel, switch expects VLAN or integer 13. Tunnel-Medium-Type → Medium, Switch expects IEEE-802 or integer 6. Tunnel-Private-Group-ID → Vlan ID, switch any tagged VLAN. in the access accept packet. If you get this working, please post back. I've got one sitting on my desk and it would be nice to do something with it other than use it as a pretty black paper weight. I quite like the routerOS stuff , it's a pitty they concentrated on all that hotspot bollocks instead of building in proper 802.1x support.
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Arran Cudbard-Bell -
Jan Schermer / ET NETERA -
tnt＠kalik.co.yu