how to send wifi connection attributes.

[Ramon Escriba]

Hi all,
I've a mac authentication schema working.
Now I want to add 802.1x Eap+Mschapv2 for WiFI/Wire.

We're using Aruba's AP.

Aruba it's very peculiar, it extends an aruba-ap vlan between the controller
& the AP's.  
The other configured vlans are secure tunnels inside this "aruba-ap" vlan.

Our Aruba wifi has 2 main vlans, one for data the other for voip (alias SSID
wifidata & wifivoip) with diff QoS.

The test user "aaa" authentication it's correct, but I'm still not able to
send to my aruba controller the vlan the 
authenticated user should be attach too. So to wifidata with a laptop, but
to wifivoip with a mobile.

I do cheat adding to the test user "aaa" a pair of radiusReplyItem
attributes:

        Aruba-User-Vlan = 4000
        Aruba-User-Role = "authenticated"

The cheat works:

(....)
++[exec] returns noop
Sending Access-Accept of id 166 to 84.89.232.250 port 32834
       Tunnel-Private-Group-Id:0 = "X1"
       Aruba-User-Vlan = 4000
       Aruba-User-Role = "authenticated"
       User-Name = "aaa"
       MS-MPPE-Recv-Key =
0x634d9e2f148f2484671e78e939bb4a9661ac05f1f242a016e9b16458538d6632
       MS-MPPE-Send-Key =
0x24d48bb9ce204be409131d3dd3226c4bb7bee7805c5dd006b25e2f9d0faca881
       EAP-Message = 0x03260004
       Message-Authenticator = 0x00000000000000000000000000000000
Finished request 55.
(...)

But without the cheat, does not. It connects correctly to the wifi, but as
is attached to an incorrect vlan
,in our case the aruba-ap vlan, it does not get a correct ip from our dhcp.

(.....)
Sending Access-Accept of id 121 to 84.89.232.250 port 32834
       Tunnel-Private-Group-Id:0 = "X1"
       User-Name = "aaa"
       MS-MPPE-Recv-Key =
0x6859e312650c6232d0b20930eba797e110036da56fb710248c676ba5558e05e0
       MS-MPPE-Send-Key =
0x3520313eb26c8f00f9a4d561aa183cc3991d38dd89d43322ad32a80437f172d9
       EAP-Message = 0x030c0004
       Message-Authenticator = 0x00000000000000000000000000000000
Finished request 10.
Going to the next request


The problem is one user "aaa" may be able to connect to wifidata & wifivoip
with diferent devices (laptop / mobile).

Any clue? Where should I force the radiusReplyItem ???

Regards.