Hi,
We have the following setup:
Wireless Client (authentication with EAP-TTLS/PAP)
|
| SSID (wlan)
\/
WLAN Access Point (NAS with EAP-PEAP, Cihpher TKIP ) -> SSID: wlan
connected to VLAN 111
|
|
\/
Radius Server
(Check if user in member of the LDAP group company-users)
If yes, check his credentials with the LDAP Server.
|
|
\/
LDAP Server (for Authentication)
Up to know this is working.
Now the idea is that the same AP is managing a second SSID called
wlan-public. This SSID should be connection too a separate VLAN (ID
113). Mostly this SSID should be used by our guests for basic Internet
access (No access to our company network)
To release that the RADIUS server must be able to detect the connected
SSID. Based on that different users groups are allowed.
We noticed that the AP is informing the Radius about the connected SSID
(see below),
but we couldn't figure out the right way to detect that the information
or too use it.
We tried to detect the value Cisco-AVPair with
/etc/freeradius/users
<snip>
# wlan-public - Connected to guest vlan - four our guest.
# (Access with user guest, password guest)
DEFAULT Cisco-AVPair =~ "ssid=wlan-public"
Reply-Message = "Your SSID:qwlan-public",
Fall-Through = Yes
# debug
DEFAULT
Reply-Message = "Cisco-AVPair: %{Cisco-AVPair[*]}",
Fall-Through = Yes
# qwlan - Connected to company vlan - for our employees -
membership company-users is needed
# (Access with every LDAP account, No access with the user guest)
DEFAULT Cisco-AVPair =~ "ssid=wlan"
Reply-Message = "Your SSID:wlan",
Fall-Through = Yes
DEFAULT Ldap-Group == "company-users"
Reply-Message = "Welcome to the Wireless Network wlan"
<\snip>
but without success.
Even based on the debug output it looks like that the value
%{Cisco-AVPair[*]} is empty?
Help would be appreciated.
Regards,
Philipp Hanselmann
--
* freeradius -X | grep Cisco
[files] expand: Cisco-AVPair: %{Cisco-AVPair[*]} -> Cisco-AVPair:
Reply-Message = "Cisco-AVPair: "
[files] expand: Cisco-AVPair: %{Cisco-AVPair[*]} -> Cisco-AVPair:
Reply-Message = "Cisco-AVPair: "
[files] expand: Cisco-AVPair: %{Cisco-AVPair[*]} -> Cisco-AVPair:
Reply-Message = "Cisco-AVPair: "
Cisco-AVPair = "ssid=wlan-public"
Cisco-AVPair = "vlan-id=113"
Cisco-AVPair = "nas-location=unspecified"
Cisco-AVPair = "connect-progress=Call Up"
* freeradius -X | grep Cisco
<snip>
++[exec] returns noop
Sending Access-Accept of id 39 to 192.168.110.210 port 1645
MS-MPPE-Recv-Key =
0xdcf7bf00aa1600ac7ba7032d9exxxxxcd5xxxxxxxxxxx115738
MS-MPPE-Send-Key = 0x8cf29e70b657866e446fb2a8c9xxxxxxxxxxxxxxxxxxxc
EAP-Message = 0x03060004
Message-Authenticator = 0x00000000000000000000000000000000
User-Name = "phanselmann"
Finished request 5.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Accounting-Request packet from host 192.168.110.21 port 1646,
id=81, length=230
Acct-Session-Id = "00000312"
Called-Station-Id = "001a.e35f.42e1"
Calling-Station-Id = "0090.4b9a.6ac4"
Cisco-AVPair = "ssid=wlan-public"
Cisco-AVPair = "vlan-id=113"
Cisco-AVPair = "nas-location=unspecified"
User-Name = "phanselmann"
Cisco-AVPair = "connect-progress=Call Up"
Acct-Authentic = RADIUS
Acct-Status-Type = Start
NAS-Port-Type = Wireless-802.11
NAS-Port = 392
NAS-Port-Id = "392"
Service-Type = Framed-User
NAS-IP-Address = 192.168.110.21
Acct-Delay-Time = 0
+- entering group preacct {...}
++[preprocess] returns ok
[acct_unique] Hashing 'NAS-Port = 392,Client-IP-Address =
192.168.110.21,NAS-IP-Address = 192.168.110.21,Acct-Session-Id =
"00000312",User-Name = "phanse"'
[acct_unique] Acct-Unique-Session-ID = "8eebd433aaed7864".
++[acct_unique] returns ok
[suffix] No '@' in User-Name = "p
</snip>
<snip>
--
Philipp Hanselmann
System Administrator
Qnamic AG
Fabrikstrasse 10
CH-4614 Hägendorf
Switzerland
Phone: +41 62 209 70 40
Fax: +41 62 209 70 44
[email protected]
www.qnamic.com
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
