Hello,
in fact you are not using an EAP connection, mean that you cannont be
autoregistered
handling radius autz request: from switch_ip => yyyy, connection_type
=>Wireless-802.11-NoEAP mac => xxx, port => 1880, username => ZZZ
(pf::radius::authorize)
Change the configuration to use WPA2 Enterprise or 802.1x and check that
you will have something like that:
handling radius autz request: from switch_ip => yyyy, connection_type
=>Wireless-802.11-EAP mac => xxx, port => 1880, username => robert
(pf::radius::authorize)
Regards
Fabrice
Le 2014-03-20 07:30, Nicola Canepa a écrit :
I restarted the client used for the tests and WPA2 worked correctly.
Now I can access the SSID through the PacketFence user, but I keep being
redirected to the captive portal, with this in the logs:
Mar 20 10:29:02 pf::WebAPI(12223) INFO: handling radius autz request: from switch_ip =>
yyyy, connection_type => Wireless-802.11-NoEAP mac => xxx, port => 1880, username
=> ZZZ (pf::radius::authorize)
Mar 20 10:29:02 pf::WebAPI(12223) INFO: Inline trigger match, the node is in
inline mode (pf::vlan::fetchVlanForNode)
Mar 20 10:29:02 pf::WebAPI(12223) INFO: MAC: xxx, PID: ccc, Status: unreg.
Returned VLAN: 119 (pf::vlan::fetchVlanForNode)
Mar 20 10:29:02 pf::WebAPI(12223) WARN: Role-based Network Access Control is
not supported on network device type pf::SNMP::Cisco::Aironet_1130.
(pf::SNMP::suppor
tsRoleBasedEnforcement)
Mar 20 10:29:02 pfdhcplistener(12318) INFO: DHCPREQUEST from xxx (_NET_.12)
(main::parse_dhcp_request)
Mar 20 10:29:02 pfdhcplistener(12318) INFO: xxx requested an IP. DHCP
Fingerprint: OS::511 (Ubuntu 11.04). Modified node with last_dhcp = 2014-03-20
10:29:02,computername = bbb,dhcp_fingerprint =
1,28,2,3,15,6,119,12,44,47,26,121,42,121,249,252,42 (main::listen_dhcp)
Mar 20 10:29:02 pfdhcplistener(12318) INFO: DHCPACK from _NET_.2 (aaa) to host
xxx (_NET_.12) for 86400 seconds (main::pars
e_dhcp_ack)
Mar 20 10:29:02 pfdhcplistener(2741) INFO: DHCPREQUEST from xxx (_NET_.12)
(main::parse_dhcp_request)
Mar 20 10:29:03 pfdhcplistener(2741) INFO: xxx requested an IP. DHCP
Fingerprint: OS::511 (Ubuntu 11.04). Modified node with last_dhcp = 2014-03-20 1
0:29:02,computername = bbb,dhcp_fingerprint =
1,28,2,3,15,6,119,12,44,47,26,121,42,121,249,252,42 (main::listen_dhcp)
Mar 20 10:29:03 pfdhcplistener(2741) INFO: DHCPACK from _NET_.2 (aaa) to host
xxx (_NET_.12) for 86400 seconds (main::parse_dhcp_ack)
Afrter trying to go to www.google.com, I'm redirected to the portal and the
logs are:
Mar 20 10:49:58 redir.cgi(0) INFO: MAC xxx shouldn't reach here. Calling access
re-evaluation. Make sure your network device configuration is correct.
(ModPerl::ROOT::ModPerl::PerlRun::usr_local_pf_html_captive_2dportal_redir_2ecgi::handler)
Mar 20 10:49:58 redir.cgi(0) INFO: re-evaluating access for node xxx (redir.cgi
called) (pf::enforcement::reevaluate_access)
Mar 20 10:49:58 redir.cgi(0) INFO: Instantiate a new iptables modification
method. pf::ipset (pf::inline::get_technique)
Mar 20 10:50:02 redir.cgi(0) INFO: xxx being redirected (default profile)
(ModPerl::ROOT::ModPerl::PerlRun::usr_local_pf_html_captive_2dportal_redir_2ecgi::handler)
Mar 20 10:50:02 redir.cgi(0) INFO: MAC xxx shouldn't reach here. Calling access
re-evaluation. Make sure your network device configuration is correct.
(ModPerl::ROOT::ModPerl::PerlRun::usr_local_pf_html_captive_2dportal_redir_2ecgi::handler)
Mar 20 10:50:02 redir.cgi(0) INFO: re-evaluating access for node xxx (redir.cgi
called) (pf::enforcement::reevaluate_access)
Mar 20 10:50:02 redir.cgi(0) INFO: Instantiate a new iptables modification
method. pf::ipset (pf::inline::get_technique)
I tried with and without the modified custom.pm (I didi a restart of packetfnce
after every file change), but with no differences.
If I activate the "Registration" flag in Configuration-Trapping, I reach the
captive portal with the username/password fields (which is correct for inline
enforcement).
Nicola
Il giorno 19/mar/2014, alle ore 18:08, Fabrice DURAND ha scritto:
Yes , it look like you are not doing wpa2 enterprise but a sort of mac tls.
Le 2014-03-19 12:46, Nicola Canepa a écrit :
Now vlan/custom.pm contains:
sub shouldAutoRegister {
my ($this, $mac, $switch_in_autoreg_mode, $violation_autoreg, $isPhone,
$conn_type, $user_name, $ssid, $eap_type) = @_;
my $logger = Log::Log4perl->get_logger();
$logger->trace("asked if should auto-register device");
# Since they already have validated credentials through EAP to do 802.1X
if (defined($conn_type) && (($conn_type & $EAP) == $EAP)) {
$logger->trace("returned yes because it's a 802.1X client that successfully
authenticated already");
return 1;
}
# otherwise don't autoreg
return 0;
}
And, if I understand correctly, conf/switches.conf contains:
inlineTrigger=ssid::GUESTSSD
Also, I have
inlineVlan=119
in switches.conf, under the
[AP_IP]
section
Am I missing something?
I keep getting lines like this in radius.log:
Wed Mar 19 17:41:41 2014 : Auth: Login incorrect: [XXX] (from client a.b.c.d
port 958 cli MAC_ADDRESS via TLS tunnel)
Wed Mar 19 17:41:41 2014 : Auth: Login incorrect: [XXX] (from client a.b.c.d
port 958 cli MAC_ADDRESS)
Nicola
Il giorno 19/mar/2014, alle ore 17:30, Fabrice DURAND ha scritto:
Hello Nicola,
yes it´s possible, you have to define the inline vlan id in the role the
user will match and enable autoregistration in
/usr/local/pf/lib/pf/vlan/custom.pm.
regards
Fabrice
Le 2014-03-19 03:24, Nicola Canepa a écrit :
Hello.
Is it possible to have a setup with inline enforcement, but without the need to
login to captive portal, but using credentials to login to the WPA2 SSID?
Since I want:
- to avoid possible mac-spoofing
- not ask the user to insert twice the same credentials
I configured my access point to autenticate through PacketFence's Radius, but I
keep getting an authentication failure.
What's wrong?
Is this possible in VLAN enforcement mode or do I have to first access the
"public" SSID in any case?
Thank you for your help.
Nicola Canepa
Tel: +39-0522-399-3474
[email protected]
-
ASCII stupid question, get a stupid ANSI!
Il contenuto della presente comunicazione è riservato e destinato
esclusivamente ai destinatari indicati. Nel caso in cui sia ricevuto da persona
diversa dal destinatario sono proibite la diffusione, la distribuzione e la
copia. Nel caso riceveste la presente per errore, Vi preghiamo di informarci e
di distruggerlo e/o cancellarlo dal Vostro computer, senza utilizzare i dati
contenuti. La presente comunicazione (comprensiva dei documenti allegati) non
avrà valore di proposta contrattuale e/o accettazione di proposte provenienti
dal destinatario, nè rinuncia o riconoscimento di diritti, debiti e/o crediti,
nè sarà impegnativa, qualora non sia sottoscritto successivo accordo da chi può
validamente obbligarci. Non deriverà alcuna responsabilità precontrattuale a
ns. carico, se la presente non sia seguita da contratto sottoscritto dalle
parti.
The content of the above communication is strictly confidential and reserved
solely for the referred addressees. In the event of receipt by persons
different from the addressee, copying, alteration and distribution are
forbidden. If received by mistake we ask you to inform us and to destroy and/or
delete from your computer without using the data herein contained. The present
message (eventual annexes inclusive) shall not be considered a contractual
proposal and/or acceptance of offer from the addressee, nor waiver recognizance
of rights, debts and/or credits, nor shall it be binding when not executed as
a subsequent agreement by persons who could lawfully represent us. No
pre-contractual liability shall apply to us when the present communication is
not followed by any binding agreement between the parties.
------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
--
Fabrice Durand
[email protected] :: +1.514.447.4918 (x135) :: www.inverse.ca
Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence
(http://packetfence.org)
------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
Nicola Canepa
Tel: +39-0522-399-3474
[email protected]
-
ASCII stupid question, get a stupid ANSI!
Il contenuto della presente comunicazione è riservato e destinato
esclusivamente ai destinatari indicati. Nel caso in cui sia ricevuto da persona
diversa dal destinatario sono proibite la diffusione, la distribuzione e la
copia. Nel caso riceveste la presente per errore, Vi preghiamo di informarci e
di distruggerlo e/o cancellarlo dal Vostro computer, senza utilizzare i dati
contenuti. La presente comunicazione (comprensiva dei documenti allegati) non
avrà valore di proposta contrattuale e/o accettazione di proposte provenienti
dal destinatario, nè rinuncia o riconoscimento di diritti, debiti e/o crediti,
nè sarà impegnativa, qualora non sia sottoscritto successivo accordo da chi può
validamente obbligarci. Non deriverà alcuna responsabilità precontrattuale a
ns. carico, se la presente non sia seguita da contratto sottoscritto dalle
parti.
The content of the above communication is strictly confidential and reserved
solely for the referred addressees. In the event of receipt by persons
different from the addressee, copying, alteration and distribution are
forbidden. If received by mistake we ask you to inform us and to destroy and/or
delete from your computer without using the data herein contained. The present
message (eventual annexes inclusive) shall not be considered a contractual
proposal and/or acceptance of offer from the addressee, nor waiver recognizance
of rights, debts and/or credits, nor shall it be binding when not executed as
a subsequent agreement by persons who could lawfully represent us. No
pre-contractual liability shall apply to us when the present communication is
not followed by any binding agreement between the parties.
------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
--
Fabrice Durand
[email protected] :: +1.514.447.4918 (x135) :: www.inverse.ca
Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence
(http://packetfence.org)
------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
Nicola Canepa
Tel: +39-0522-399-3474
[email protected]
-
ASCII stupid question, get a stupid ANSI!
Il contenuto della presente comunicazione è riservato e destinato
esclusivamente ai destinatari indicati. Nel caso in cui sia ricevuto da persona
diversa dal destinatario sono proibite la diffusione, la distribuzione e la
copia. Nel caso riceveste la presente per errore, Vi preghiamo di informarci e
di distruggerlo e/o cancellarlo dal Vostro computer, senza utilizzare i dati
contenuti. La presente comunicazione (comprensiva dei documenti allegati) non
avrà valore di proposta contrattuale e/o accettazione di proposte provenienti
dal destinatario, nè rinuncia o riconoscimento di diritti, debiti e/o crediti,
nè sarà impegnativa, qualora non sia sottoscritto successivo accordo da chi può
validamente obbligarci. Non deriverà alcuna responsabilità precontrattuale a
ns. carico, se la presente non sia seguita da contratto sottoscritto dalle
parti.
The content of the above communication is strictly confidential and reserved
solely for the referred addressees. In the event of receipt by persons
different from the addressee, copying, alteration and distribution are
forbidden. If received by mistake we ask you to inform us and to destroy and/or
delete from your computer without using the data herein contained. The present
message (eventual annexes inclusive) shall not be considered a contractual
proposal and/or acceptance of offer from the addressee, nor waiver recognizance
of rights, debts and/or credits, nor shall it be binding when not executed as
a subsequent agreement by persons who could lawfully represent us. No
pre-contractual liability shall apply to us when the present communication is
not followed by any binding agreement between the parties.
------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
--
Fabrice Durand
[email protected] :: +1.514.447.4918 (x135) :: www.inverse.ca
Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence
(http://packetfence.org)
------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
