Requesting help with FR + Dynamic vlans

[Alan DeKok]

Jacob Jarick wrote:
> * school with wireless access
> * allready uses radius (soon to be freeradius)
> * freeradius auth's via a win2k3 Active Directory Server
> * teachers need to be able to log into WAP's a,b,c etc and be
> automatically assigned to the teachers vlan
> * priv students need to be able to log into WAP's a,b,c and be
> assigned to the priv student vlan
> * norm students simply need to have network access denied from WAP's a,b,c
> 
> 
>>From what Ive learnt so far today, I need to configure the radius.conf
> to retrieve the users group from the ADS and then return auth and map
> group -> vlan / tunnel ID.

  Yes.  You should be able to do that via the LDAP-Group attribute.  In
the "users" file, do:

DEFAULT LDAP-Group == "norm-students", NAS-IP-Address == a, Auth-Type :=
Reject

DEFAULT LDAP-Group == "norm-students", NAS-IP-Address == b, Auth-Type :=
Reject

DEFAULT LDAP-Group == "norm-students", NAS-IP-Address == c, Auth-Type :=
Reject

DEFAULT LDAP-Group == "priv-students"
	... assign VLAN (see NAS documentation for what attributes)

DEFAULT LDAP-Group == "teacher"
	... assign VLAN (see NAS documentation for what attributes)

  Alan DeKok.
--
  http://deployingradius.com       - The web site of the book
  http://deployingradius.com/blog/ - The blog