I solved it myself! It seems that the fact that SNMP location was empty made
packetfence barf.
I ran this on the HP 1920's:
snmp-agent sys-info contact Jes Kasper Klittum
snmp-agent sys-info location Server room 1
Now deauth is working!
Br,
Jes
Fra: Jes Kasper Klittum
Sendt: 10. marts 2017 09:10
Til: 'packetfence-users@lists.sourceforge.net'
<packetfence-users@lists.sourceforge.net>
Emne: SV: [PacketFence-users] Wired VLAN switch from Registration LAN to Guest
LAN not working?
Hi Fabrice,
Okay, I checked and this is what happens:
pfqueue.log:
Mar 10 08:59:10 pfqueue(18346) ERROR: [mac:d0:67:e5:36:6f:79] error creating
SNMP v2c write connection to xx.xx.xx.xx: Received wrongLength(8) error-status
at error-index 1 it looks like you specified a read-only community instead of a
read-write one (pf::Switch::connectWriteTo)
Mar 10 08:59:14 pfqueue(18346) ERROR: [mac:d0:67:e5:36:6f:79] error creating
SNMP v2c write connection to xx.xx.xx.xx: Received wrongLength(8) error-status
at error-index 1 it looks like you specified a read-only community instead of a
read-write one (pf::Switch::connectWriteTo)
Mar 10 08:59:15 pfqueue(18353) WARN: [mac:d0:67:e5:36:6f:79] Until CoA is
implemented we will bounce the port on VLAN re-assignment traps for MAC-Auth
(pf::Switch::handleReAssignVlanTrapForWiredMacAuth)
Mar 10 08:59:16 pfqueue(18353) ERROR: [mac:d0:67:e5:36:6f:79] error creating
SNMP v2c write connection to xx.xx.xx.xx: Received wrongLength(8) error-status
at error-index 1 it looks like you specified a read-only community instead of a
read-write one (pf::Switch::connectWriteTo)
Mar 10 08:59:19 pfqueue(18360) WARN: [mac:d0:67:e5:36:6f:79] Until CoA is
implemented we will bounce the port on VLAN re-assignment traps for MAC-Auth
(pf::Switch::handleReAssignVlanTrapForWiredMacAuth)
Mar 10 08:59:19 pfqueue(18360) ERROR: [mac:d0:67:e5:36:6f:79] error creating
SNMP v2c write connection to xx.xx.xx.xx: Received wrongLength(8) error-status
at error-index 1 it looks like you specified a read-only community instead of a
read-write one (pf::Switch::connectWriteTo)
Mar 10 08:59:20 pfqueue(18353) ERROR: [mac:d0:67:e5:36:6f:79] error creating
SNMP v2c write connection to xx.xx.xx.xx: Received wrongLength(8) error-status
at error-index 1 it looks like you specified a read-only community instead of a
read-write one (pf::Switch::connectWriteTo)
Mar 10 08:59:23 pfqueue(18360) ERROR: [mac:d0:67:e5:36:6f:79] error creating
SNMP v2c write connection to xx.xx.xx.xx: Received wrongLength(8) error-status
at error-index 1 it looks like you specified a read-only community instead of a
read-write one (pf::Switch::connectWriteTo)
And the SNMP capture shows:
08:55:59.522952 IP 10.4.100.11.snmp > pf.45173: C=readonlycommunity
GetResponse(28) system.sysLocation.0=""
08:55:59.529316 IP 10.4.100.11.snmp > pf.45173: C=readonlycommunity
GetResponse(32) 17.1.4.1.2.1=1
08:59:10.715242 IP 10.4.100.11.snmp > pf.51933: C=rwcommunity GetResponse(28)
system.sysLocation.0=""
08:59:10.721720 IP 10.4.100.11.snmp > pf.51933: C=rwcommunity GetResponse(28)
wrongLength@1 system.sysLocation.0=""
08:59:14.729103 IP 10.4.100.11.snmp > pf.35982: C=rwcommunity GetResponse(28)
system.sysLocation.0=""
08:59:14.733464 IP 10.4.100.11.snmp > pf.35982: C=rwcommunity GetResponse(28)
wrongLength@1 system.sysLocation.0=""
08:59:15.736802 IP 10.4.100.11.snmp > pf.58710: C=rwcommunity GetResponse(28)
system.sysLocation.0=""
08:59:16.241273 IP 10.4.100.11.snmp > pf.58710: C=rwcommunity GetResponse(28)
wrongLength@1 system.sysLocation.0=""
08:59:19.755135 IP 10.4.100.11.snmp > pf.37131: C=rwcommunity GetResponse(28)
system.sysLocation.0=""
08:59:19.760231 IP 10.4.100.11.snmp > pf.37131: C=rwcommunity GetResponse(28)
wrongLength@1 system.sysLocation.0=""
The switch setup:
[HP-1920]display snmp-agent community write
Community name: rwcommunity
Group name: rwcommunity
Storage-type: nonVolatile
[HP-1920]display snmp-agent community read
Community name: readonlycommunity
Group name: readonlycommunity
Storage-type: nonvolatile
Packetfence switch definition:
[xx.xx.xx.xx]
description=HP-1920-1
cliAccess=Y
group=HP-ProCurve-1920
cliEnablePwd=Jinhuna1920unauthorized
mode=production
[group HP-ProCurve-1920]
mode=registration
SNMPCommunityRead=readonlycommunity
description=HP ProCurve 1920
User-authVlan=10
cliPwd=MyTelnetPassword
cliTransport=Telnet
PrinterVlan=5
registrationVlan=102
SNMPCommunityWrite=rwcommunity
guestVlan=105
cliUser=admin
defaultVlan=102
deauthMethod=SNMP
type=H3C::S5120
Machine-authVlan=10
isolationVlan=103
radiusSecret= MYRADIUSSECRET
SNMPVersion=2c
cliEnablePwd=Jinhua1920unauthorized
ServerLANVlan=1
TidsregistreringVlan=7
ManagementVlan=100
machineVlan=10
So, as far as I can see, the switch definition is correct, the switch setup is
correct, but something goes wrong anyway...
I can do an snmpwalk -v2c -c rwcommunity xx.xx.xx.xx from the pf server with no
issues.
Any ideas?
Br,
Jes
Fra: Durand fabrice [mailto:fdur...@inverse.ca]
Sendt: 10. marts 2017 03:40
Til:
packetfence-users@lists.sourceforge.net<mailto:packetfence-users@lists.sourceforge.net>
Emne: Re: [PacketFence-users] Wired VLAN switch from Registration LAN to Guest
LAN not working?
Hello Jes,
what i can suggest is to use snmp for deauth and from the pf server capture
snmp traffic to see what happen exactly (maybe community write issue).
Also check the log in pfqueue.log , this is the place where you will see error
about the deauth.
Regards
Fabrice
Le 2017-03-02 à 11:22, Jes Kasper Klittum a écrit :
Hey folks,
So I am almost there with my PF setup. Lodovic helped me on the way to get
machine and AD user auth/switching working. Thank you very much. :)
Now, the thing I am now struggling with is the switch from registration vlan to
guest network not functioning correctly.
The only source I have in the default captive portal is email, so when I plug
an unregistered device into the network, I am lead to the portal to register
using email. I have set a 10 minute windows for accepting the registration.
I get to the portal fine, on VLAN 102, and enter my email address, at which
point I am told that the network access is being enabled. After waiting a
while, I am told that it did not work, and I should try to refresh or open a
new tab. No matter what I do, I stay in the registration VLAN?
Packetfence.log shows this:
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:unknown] Instantiate profile
default (pf::Portal::ProfileFactory::_from_profile)
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:d0:67:e5:36:6f:79] Instantiate
profile default (pf::Portal::ProfileFactory::_from_profile)
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:d0:67:e5:36:6f:79] Instantiate
profile default (pf::Portal::ProfileFactory::_from_profile)
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:d0:67:e5:36:6f:79] Releasing
device (captiveportal::PacketFence::DynamicRouting::Module::Root::release)
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:d0:67:e5:36:6f:79] User default
has authenticated on the portal. (Class::MOP::Class:::after)
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:d0:67:e5:36:6f:79] Instantiate
profile default (pf::Portal::ProfileFactory::_from_profile)
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:d0:67:e5:36:6f:79] re-evaluating
access (manage_register called) (pf::enforcement::reevaluate_access)
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:d0:67:e5:36:6f:79] is currentlog
connected at (10.4.100.11) ifIndex 23 registration
(pf::enforcement::_should_we_reassign_vlan)
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:d0:67:e5:36:6f:79] Instantiate
profile default (pf::Portal::ProfileFactory::_from_profile)
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:d0:67:e5:36:6f:79] Connection
type is WIRED_MAC_AUTH. Getting role from node_info
(pf::role::getRegisteredRole)
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:d0:67:e5:36:6f:79] Username was
defined "d067e5366f79" - returning role 'guest' (pf::role::getRegisteredRole)
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:d0:67:e5:36:6f:79] PID:
"j...@klittum.dk"<mailto:j...@klittum.dk>, Status: reg Returned VLAN:
(undefined), Role: guest (pf::role::fetchRoleForNode)
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:d0:67:e5:36:6f:79] VLAN
reassignment required (current VLAN = 102 but should be in VLAN 105)
(pf::enforcement::_should_we_reassign_vlan)
Mar 02 17:13:03 httpd.portal(20242) INFO: [mac:d0:67:e5:36:6f:79] switch port
is (10.4.100.11) ifIndex 23 connection type: Wired MAC Auth
(pf::enforcement::_vlan_reevaluation)
So packetfence knows it should switch to VLAN 105 - it just does not happen?
The switch, an HP 1920, shows this in the console:
%Apr 27 18:48:24:397 2000 GW-X1-1920-2 PORTSEC/5/PORTSEC_VIOLATION:
-IfName=GigabitEthernet1/0/23-MACAddr=D0:67:E5:36:6F:79-VlanId=-102-IfStatus=Up;
Intrusion detected.
If I unplug the Ethernet cable, and plug it back in, then I get access, and
VLAN is changed to 105.
I have tried both radius and SNMP as deauth metod on the switch.
By the way, I should not that VLAN switching on the switch works perfectly when
using a domain joined computer, and logging in/out with users with different
roles, so it seems the switch is able to get the information from packetfence
under those circumstances.
Hope someone is able to help me with this issue...
Jes
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
PacketFence-users mailing list
PacketFence-users@lists.sourceforge.net<mailto:PacketFence-users@lists.sourceforge.net>
https://lists.sourceforge.net/lists/listinfo/packetfence-users
------------------------------------------------------------------------------
Announcing the Oxford Dictionaries API! The API offers world-renowned
dictionary content that is easy and intuitive to access. Sign up for an
account today to start using our lexical data to power your apps and
projects. Get started today and enter our developer competition.
http://sdm.link/oxford
_______________________________________________
PacketFence-users mailing list
PacketFence-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/packetfence-users
