(RADIATOR) 802.1x (PEAP w/ MSCHAPV2) to Active Directory with VLAN assignment

Virgil virgil at webcentral.com.au
Thu Sep 8 18:13:25 CDT 2005


Hi all,

The goal is 802.1x for wireless and public wired ports using PEAP and
MSCHAPv2. Theoretically, this involves the least amount of configuration on
the clients, which are mainly Windows XP.

Successful authentication will also provide a per-user (or Group) VLAN
assignment, with provision for guest vlan access for non 802.1x clients, and
failed authentication.

Ideally, I'd like to use the userPrincipalName (UPN) authenticate against
Active Directory, with a specified attribute, "pager" in this case, for the
Tunnel-Private-Group-ID.

What I have working so far is EAP-PEAP , with the VLAN assignment.  This is
because I'm using AuthBy LSA for MSCHAPV2.  But I cannot work out how to get
an LDAP2 AuthAttrDef parameter to work after the EAP challenge.  I've tried
adding a second LDAP AuthBy with NoEAP and it doesn't work.

Radiator is running on Windows 2003, on the DC in this case.
Test clients are currently a Linux machine with xsupplicant
(xsupplicant-1.0.1-1.1.fc2.rf) and a Windows 2000 SP4 machine.  Both are
testing wired mode only at the moment.

Anyone have any suggestions?  Or see where I've gone wrong?

Regards
Virgil

-- 
virgil at webcentral.com.au



Cisco switch config:

aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius
dot1x system-auth-control
dot1x guest-vlan supplicant
radius-server host 172.26.100.2 auth-port 1812 acct-port 1813 key mysecret

interface FastEthernet0/1
 description ogre 802.1x supplicant
 switchport mode access
 udld port aggressive
 dot1x port-control auto
 dot1x timeout quiet-period 30
 dot1x timeout reauth-period 4000
 dot1x guest-vlan 666
 dot1x reauthentication
 spanning-tree portfast
!
interface FastEthernet0/2
 description laptop 802.1x
 switchport mode access
 udld port aggressive
 dot1x port-control auto
 dot1x timeout quiet-period 30
 dot1x timeout reauth-period 4000
 dot1x guest-vlan 666
 dot1x reauthentication
 spanning-tree portfast


Radiator configs:
"VOIP" in the configs, is the domain name, as this server is being used by
another team member.

Foreground
LogStdout
LogDir        c:/Program Files/Radiator/logs
DbDir            c:/Program Files/Radiator

Trace           4

AuthPort        1812
AcctPort        1813

BindAddress     172.26.100.2
Identifier      VOIPDC

<Client DEFAULT>
    Secret    mysecret
    DupInterval 0
</Client>

<AuthLog FILE>
    Identifier  LogLocal
    Filename    %L/authlog
    LogSuccess    1
    LogFailure    1
</AuthLog>

<AuthLog FILE>
    Identifier  NoLog
    Filename    %L/blah
    LogSuccess    0
    LogFailure    0
</AuthLog>

<AuthBy FILE>
    Identifier            USERS
    Filename             %D/users
</AuthBy>

<AuthBy FILE>
    Identifier            USERS-MD5
    Filename             %D/users
    EAPType             MD5-Challenge
</AuthBy>

<AuthBy FILE>
    Identifier            USERS-PEAP
    Filename             %D/users
    EAPType             PEAP
    EAPTLS_CAFile        %D/certificates/demoCA/cacert.pem
    EAPTLS_CertificateFile    %D/certificates/cert-srv.pem
    EAPTLS_CertificateType    PEM
    EAPTLS_PrivateKeyFile    %D/certificates/cert-srv.pem
    EAPTLS_PrivateKeyPassword    whatever
    EAPTLS_MaxFragmentSize    1000
    SSLeayTrace            4
</AuthBy>

<AuthBy LSA>
    Identifier            VOIP-LSA-MSCHAP
    Domain             VOIPDC
    EAPType             MSCHAP-V2
</AuthBy>

<AuthBy LDAP2>
    Identifier            VOIP-LDAP
    NoEAP
    Host                voipdctest
    FailureBackoffTime    10
    Port                3268
    #RewriteUsername        s/^([^@]+).*/$1/
    ServerChecksPassword
    NoDefault
    AutoMPPEKeys

    AuthDN            cn=Administrator,cn=Users,DC=server-voip,DC=test
    AuthPassword        cisco123
    BaseDN            cn=Users,DC=server-voip,DC=test
    #UsernameAttr        sAMAccountName
    UsernameAttr        userPrincipalName
    AuthAttrDef            pager,Tunnel-Private-Group-ID,reply
    AddToReplyIfNotExist    Tunnel-Type = VLAN,\
                    Tunnel-Medium-Type = Ether_802
</AuthBy>

<AuthBy LDAP2>
    Identifier            VOIP-LDAP-PEAP
    EAPType             PEAP
    EAPTLS_CAFile        %D/certificates/demoCA/cacert.pem
    EAPTLS_CertificateFile    %D/certificates/cert-srv.pem
    EAPTLS_CertificateType    PEM
    EAPTLS_PrivateKeyFile    %D/certificates/cert-srv.pem
    EAPTLS_PrivateKeyPassword    whatever
    EAPTLS_MaxFragmentSize    1000
    SSLeayTrace            4
    EAPAnonymous        %0

    Host                voipdctest
    FailureBackoffTime    10
    Port                3268
    #RewriteUsername        s/^([^@]+).*/$1/
    ServerChecksPassword
    NoDefault
    AutoMPPEKeys

    AuthDN            cn=Administrator,cn=Users,DC=server-voip,DC=test
    AuthPassword        cisco123
    BaseDN            cn=Users,DC=server-voip,DC=test
    #UsernameAttr        sAMAccountName
    UsernameAttr        userPrincipalName
</AuthBy>

<AuthBy GROUP>
    Identifier            PEAP-INNER
    #AuthByPolicy        ContinueUntilReject
    AuthByPolicy        ContinueWhileAccept
    AuthBy            VOIP-LSA-MSCHAP
    AuthBy            VOIP-LDAP
</AuthBy>


<Handler Request-Type = Accounting-Request>
    AuthLog            NoLog
</Handler>

<Handler TunnelledByPEAP=1>
        AuthBy            PEAP-INNER
</Handler>


<Handler NAS-IP-Address=/(172.26.100.\d+)/, NAS-Port-Type=Ethernet,
Service-Type=Framed-User>
#dot1x auth on visitor switch

    AuthBy            VOIP-LDAP-PEAP
    RejectHasReason
    AcctLogFileName        %L/detail
</Handler>



Trace 4 logs attached.
xsupplicant: log1.txt

win2000 sp4 w/ "user" - ie no realm for UPN: log2.txt
win2000sp4 with UPN: log3a.txt and log3b.txt



....
default xsupplicant.conf

    identity = <BEGIN>test30<END>
    allow_types = eap_mschapv2

      # right now you can do any of these methods in PEAP:
      eap-mschapv2 {
        username = <BEGIN_UNAME>test30<END_UNAME>
        password = <BEGIN_PASS>Hello123<END_PASS>
      }
  }

}

[root at ogre etc]# xsupplicant -i eth0 -d 10
Using default config!
network_list: all
Default network: "default"
Startup command: "echo "some command""
First_Auth command: "dhclient %i"
Reauth command: "echo "authenticated user %i""
Logfile: "/var/log/xsupplicant.log"
Allow Types: ALL
ID: "test30 at server-voip.test"
peap root_cert: "/usr/share/xsupplicant/root.der"
peap root_dir: "/usr/share/xsupplicant/"
peap crl_dir: "/usr/share/xsupplicant/"
peap chunk: 1398
peap rand: "/dev/urandom"
Session Resumption = YES
PEAP Allow Type: MSCHAPV2
mschapv2 username: "test30"
mschapv2 password: "Hello123"
"some command"








-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: log1.txt
URL: <http://www.open.com.au/pipermail/radiator/attachments/20050909/fd01f60b/attachment.txt>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: log2.txt
URL: <http://www.open.com.au/pipermail/radiator/attachments/20050909/fd01f60b/attachment-0001.txt>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: log3a.txt
URL: <http://www.open.com.au/pipermail/radiator/attachments/20050909/fd01f60b/attachment-0002.txt>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: log3b.txt
URL: <http://www.open.com.au/pipermail/radiator/attachments/20050909/fd01f60b/attachment-0003.txt>


More information about the radiator mailing list