[RADIATOR] Radiator using WPA2-Enterprise and dynamic VLAN Assignment (Part 1)

Roberto Pantoja rpantoja at lageo.com.sv
Wed Mar 26 14:24:39 CDT 2014


Thank you, I will try tagging values for the reply...

On 03/26/2014 12:47 PM, Sami Keski-Kasari wrote:
> Hello Roberto,
>
> The RFC2868 defines that tunnel attributes includes Tag field before
> value. Some NASes are needing that it is defined and some not.
>
> Try for example with
>
> mikem2  User-Password=fred
>         Service-Type = Framed-User,
>         Tunnel-Private-Group-ID = 0:<vlan-id>,
>         Tunnel-Medium-Type = 0:802,
>         Tunnel-Type = 0:VLAN
>
> or
> mikem2  User-Password=fred
>         Service-Type = Framed-User,
>         Tunnel-Private-Group-ID = 1:<vlan-id>,
>         Tunnel-Medium-Type = 1:802,
>         Tunnel-Type = 1:VLAN
>
>
> Best Regards,
>  Sami
>
> On 03/26/2014 08:16 PM, Roberto Pantoja wrote:
>> Thank you for your promptly answer, but I have the same effect if I put
>> the VLAN name or numeric ID. Do you have any other idea that can help me
>> to resolve this problem.
>>
>> Best regards.
>>
>> On 03/26/2014 11:37 AM, Hartmaier Alexander wrote:
>>> On 2014-03-26 18:40, Roberto Pantoja wrote:
>>>> I have a problem trying to assign dynamic VLANs to users on a 
>>>> WPA2-Enterprise configuration. Users have successful authentication
>>>> and if I don't send the Radius Attribute "Tunnel-Private-Group-ID"
>>>> The Wireless Controller connects me to the default VLan for the SSID,
>>>> but when I send "Tunnel-Private-Group-ID", the Wireless Controller
>>>> simply drops out my connection. The Wireless controller documentation
>>>> says the required attributes in the Access-Accept Reply are
>>>> "Tunnel-Type=VLAN, Tunnel-Medium-Type=802,
>>>> Tunnel-Private-Group-ID=<Name of VLAN>".  Everything works fine using
>>>> Ignition Server (Avaya's Radius Server). But on product's
>>>> documentation says WC8180 comply with RFC Standards and mentions to
>>>> be "compatible and validated" with freeradius and Microsoft IAS, so I
>>>> think my case is a configuration issue.
>>>>
>>>> Regards.
>>>>
>>>> Radiator Version: 4.12.1
>>>> Wireless Controller: AVAYA WC8180
>>>> Wireless Access Points: AVAYA AP8120
>>>>
>>>> Config file:
>>>> *** Config File ***
>>>> # radius.cfg
>>>>
>>>> Foreground
>>>> LogStdout
>>>> LogDir          /var/log/radius
>>>> LogFile         %L/logfile.%Y.%m.%d
>>>> DbDir           /etc/radiator
>>>> # User a lower trace level in production systems:
>>>> Trace           4
>>>> AuthPort 1812
>>>> AcctPort 1813
>>>>
>>>> <Client 10.0.30.254>
>>>>         Secret verysecret
>>>>         PacketTrace
>>>>         Identifier Avaya WC8180
>>>> </Client>
>>>>
>>>> <Handler TunnelledByPEAP=1>
>>>>         <AuthBy FILE>
>>>>                 Filename %D/users
>>>>                 EAPType MSCHAP-V2
>>>>         </AuthBy>
>>>> </Handler>
>>>>
>>>> <Handler>
>>>>         <AuthBy FILE>
>>>>                 Filename %D/users
>>>>                 EAPType PEAP
>>>>                 EAPTLS_CAFile %D/certificates/cacert.pem
>>>> #               EAPTLS_CAPath
>>>>                 EAPTLS_CertificateFile %D/certificates/radiator-cert.pem
>>>>                 EAPTLS_CertificateType PEM
>>>>                 EAPTLS_PrivateKeyFile %D/certificates/radiator-key.pem
>>>>                 EAPTLS_PrivateKeyPassword verysecret
>>>> #               EAPTLS_RandomFile %D/certificates/random
>>>>                 EAPTLS_MaxFragmentSize 1024
>>>> #               EAPTLS_DHFile %D/certificates/cert/dh
>>>>                 #EAPTLS_CRLCheck
>>>>                 #EAPTLS_CRLFile %D/certificates/crl.pem
>>>>                 #EAPTLS_CRLFile %D/certificates/revocations.pem
>>>>                 AutoMPPEKeys
>>>>                 #EAPTLS_SessionResumption 0
>>>>                 #EAPTLS_SessionResumptionLimit 10
>>>>                 ####EAPAnonymous anonymous at localhost
>>>>                 EAPTLS_PEAPVersion 0
>>>>                 EAPTTLS_NoAckRequired
>>>>         </AuthBy>
>>>> </Handler>
>>>> *** EOF Config File ***
>>>>
>>>>
>>>> Users file:
>>>> mikem user without VLAN default VLAN - Quarantine - no IP address
>>>> mikem1 user with VLAN Empleados - IP address range 10.0.21.0/24
>>>> mikem2 user with VLAN ATI - IP address range 10.0.19.0/24
>>>> *** Users file ***
>>>> # users
>>>> # This is an example of how to set up simple user for
>>>> # AuthBy FILE.
>>>> # The example user mikem has a password of fred, and will
>>>> # receive reply attributes suitable for most NASs.
>>>> # You can do many more interesting things. See the Radiator reference
>>>> # manual for more details
>>>> #
>>>> # You can test this user with the command
>>>> #  perl radpwtst
>>>>
>>>> mikem   User-Password=fred
>>>>         Service-Type = Framed-User,
>>>>         Tunnel-Medium-Type = 802,
>>>>         Tunnel-Type = VLAN
>>>>
>>>> mikem1  User-Password=fred
>>>>         Service-Type = Framed-User,
>>>>         Tunnel-Private-Group-ID = Empleados,
>>>>         Tunnel-Medium-Type = 802,
>>>>         Tunnel-Type = VLAN
>>>>
>>>> mikem2  User-Password=fred
>>>>         Service-Type = Framed-User,
>>>>         Tunnel-Private-Group-ID = ATI,
>>>>         Tunnel-Medium-Type = 802,
>>>>         Tunnel-Type = VLAN
>>>>
>>>> *** EOF users file ***
>>> We're doing that with Cisco WLCs without problems but in our case by
>>> sending the VLAN ID, not its name like for wired dot1x where Cisco IOS
>>> switches want the VLAN name:
>>>
>>> AddToReply Tunnel-Type=VLAN,\
>>>                Tunnel-Medium-Type=802, \
>>>                Tunnel-Private-Group-ID=123
>>>
>>>> -- 
>>>> ---------------------------------------
>>>> Roberto Carlos Pantoja Valdizón
>>>> Analista de Sistemas
>>>> ATI/GDEI/LaGeo
>>>>
>>>>
>>>> This message has been scanned for malware by Websense.
>>>> www.websense.com <http://www.websense.com/>
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> radiator mailing list
>>>> radiator at open.com.au
>>>> http://www.open.com.au/mailman/listinfo/radiator
>>>
>>>
>>> *"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
>>> T-Systems Austria GesmbH Rennweg 97-99, 1030 Wien
>>> Handelsgericht Wien, FN 79340b
>>> *"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
>>> Notice: This e-mail contains information that is confidential and may
>>> be privileged.
>>> If you are not the intended recipient, please notify the sender and then
>>> delete this e-mail immediately.
>>> *"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
>>>
>>>
>>> Click here
>>> <https://www.mailcontrol.com/sr/X7j9AwsBAS3GX2PQPOmvUmkxeMeR4%21FmwYL%21b%21gsSiAI7lo7et4NX6Fo9FCU0sXr2U9s6bVQO2bgE3KctAewCA==>
>>> to report this email as spam.
>>>
>>>
>>>
>>> _______________________________________________
>>> radiator mailing list
>>> radiator at open.com.au
>>> http://www.open.com.au/mailman/listinfo/radiator
>>
>>
>>
>> _______________________________________________
>> radiator mailing list
>> radiator at open.com.au
>> http://www.open.com.au/mailman/listinfo/radiator
>>
>


-- 
---------------------------------------
Roberto Carlos Pantoja Valdizón
Analista de Sistemas
ATI/GDEI/LaGeo



More information about the radiator mailing list