Grant access for all users before login
Hi I'm using freeradius with ldap users and mschap + peap. But i have one problem. When a user gets his login prompt, no access to the network is allowed because they first get access when they login and freeradius can perform an ldap check with the username. But when a new user wants to login or the user uses an different computer, the user dosen't exist on this machine -> so they can't login -> no network connection ->can't load profile -> no local user. So i have tested a little bit with guest vlan ... but this didn't solve my problem. What can i do to solve this issue? I think it will be possible if alle users get access to an restricted vlan before they login with their user credentials. Then the profile can be loaded from server and then the user can validate. But how can i do this, that every user get access before login? I'll hope you understand my problem und you can give me some futher hints what i can do to solve this. best regards -- View this message in context: http://freeradius.1045715.n5.nabble.com/Grant-access-for-all-users-before-lo... Sent from the FreeRadius - User mailing list archive at Nabble.com.
When a user gets his login prompt, no access to the network is allowed because they first get access when they login and freeradius can perform an ldap check with the username. But when a new user wants to login or the user uses an different computer, the user dosen't exist on this machine -> so they can't login -> no network connection ->can't load profile -> no local user.
Use machine authentication (if wireless, use "automatic connect").
Garber, Neal-2 wrote:
When a user gets his login prompt, no access to the network is allowed because they first get access when they login and freeradius can perform an ldap check with the username. But when a new user wants to login or the user uses an different computer, the user dosen't exist on this machine -> so they can't login -> no network connection ->can't load profile -> no local user.
Use machine authentication (if wireless, use "automatic connect").
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ok that means i must install the certificate (ca.der) on the client. And what else i have to do that the client perform an machine authentication before the user logins? is it neccessary to change some freeradius configuration parameters? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Grant-access-for-all-users-before-lo... Sent from the FreeRadius - User mailing list archive at Nabble.com.
snowman5840 wrote:
Garber, Neal-2 wrote:
Use machine authentication (if wireless, use "automatic connect").
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ok that means i must install the certificate (ca.der) on the client. And what else i have to do that the client perform an machine authentication before the user logins? is it neccessary to change some freeradius configuration parameters?
Ok machine authentication works now with computer name from samba. i can assign vlans also. The switch port appears as up, BUT i can't ping the machine und i can't login with new users that never before use this machine (no local user account). Why i doesn't get network access after successful machine authentification!? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Grant-access-for-all-users-before-lo... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Ok machine authentication works now with computer name from samba. i can assign vlans also. The switch port appears as up, BUT i can't ping the machine und i can't login with new users that never before use this machine (no local useraccount). Why i doesn't get network access after successful machine authentification!?
If your authentication is successful and you're sure the port is being put in the correct VLAN, then you should use standard network troubleshooting techniques. Not that it's in scope for this list, but here are some thought starters: - Does the device have an IP address? - If so, is it in the VLAN you expected? - Are the network mask and default gateway correct? - Can you ping the switch to which you are connected? - When you ping the switch, do you get an ARP response? - Are there ACL's or firewalls that might be blocking traffic to other networks?
participants (2)
-
Garber, Neal -
snowman5840