Radius+Ldap:Allow the same host in multiple vlans

[Ramon Escriba]

Hi
I'm trying to organize my net using 802.1x able switches with freeradius
2.1.1+Openldap2-2.4+OpenSuse11.1 

The system is running, at least @ test level but not yet deployed, but I
reach a cross road and finally I've to choose.

Or having one ldap subtree per vlan, filled with all host that bellong to
this one, or store inside
the host attributes all vlans it's allowed or may get in. 

The first "road" it's the one I've working actually, because I don't know
how to implement the second, the elegant one.

I have multiple devices that may belong to multiple vlans, so I shall have
duplicated hosts, which I don't like @ all. 

In order to keep things easy I only  use mac-"authentication", later 802.1x
EAP wit user+pass ( EAP Mschapv2 or TTLS).

The idea is to declare in one single place the vlans one host may be able to
connect, 
from the first top priority vlan to try up to the last option..

Well, I'm using the radiusprofile attribute radiusTunnelGroupId to store the
Vlan name or tag.

If I set one host/user with the next "vlan tag" attributes:

Uid=John.Cleese,ou=People,ou=Radius,xxxxxxxxxxxxxx
...
radiusTunnelGroupId: 666  (Mad Scientist) 
radiusTunnelGroupId: 128  (Nut Engineers)
radiusTunnelGroupId: 256 (Nerd IT guys)
radiusTunnelGroupId: 51 ( blackhole control)
...
userPassword XXXXXXXXXXXXXXXXX

Or

Uid=<mac-address>,ou=Devices,ou=Radius,xxxxxxxxxxxxxx
cn: stupid.device.001
...
radiusTunnelGroupId: 666  (Mad scientist) 
radiusTunnelGroupId: 999  (FusionCore)
...


The host/user, may have rights to connect to those vlans, from let say top
prority (666) to the lesser one (51) [ldap attribute order], 
in the first case, and only  666 or 999 in the second.

Some areas are restrited so only the ones with physical access may get
connection to the right vlan.

The problem is how may I configure radius so it may choose the "correct"
vlan. Or try one and if not possible keep trying 
until no more choices are available.

I also have "hungroups", but I realized, if I'm not wrong, that freeradius
only gets the first match, never tries the others, so:

BlackHoleCore NAS-IP-Address == 10.0.0.1
VacuumCleaner NAS-IP-Address == 10.0.0.1
CoffeeMachine NAS-IP-Address == 10.0.0.1

When in freeradius "users" file I try "DEFAULT Huntgroup-Name ==
CoffeeMachine, Auth-Type = LDAPCoffee" it will never get in, 
because NAS-IP 10.0.0.1 will always match BlackHoleCore, never the others.(
It's ok?? Or I'm wrong or may I have to change 
something to get/force/allow multiple target??)


A "problem" I found,I'm a newby in radius, is that I'm not able to choose
between the diferent vlans, 
as radius always try to match first value of multivaluated attributes
(radiusTunnelGroupId). I'm wrong again?

Freeradius send the ACK-OK to the NAS-switch with the target Vlan for this
device. If the "sent" vlan is not extended to that switch-NAS 
there fails silently( @ least seems so in Extreme networks), so the device
is not connected.

I was trying to use the "checkval" module, but I don't know it's the way it
was thinked off.
As far as I undertand I can not use it, maybe I'm wrong again. There's any
elegant way to do it?

Is that aproach, try the "next vlan" if exists @ ldap, possible, how?

Many Thanks.