Hi all,
I've seen other posts with similar titles, but I can't seem to make sense of
what I need to do.
Following some of the troubleshooting from other posts I found the following.
I have machine authentication seemingly working, along with auto-registration.
When 802.1x authenticates the machine to my AD, it registers the machine in
packetfence, but it does not assign the role, so the switch puts the port in
the management vlan.
I have a catch-all rule in my machine authentication source saying
1. assign role "PomOffice_18"
2. set access duration 1 year.
When the port comes up I see :
Aug 1 20:32:10: %AUTHMGR-5-START: Starting 'dot1x' for client (e0db.55e9.4328)
on Interface Gi0/16 AuditSessionID AC1000C30000014543120991
Aug 1 20:32:10: %DOT1X-5-SUCCESS: Authentication successful for client
(e0db.55e9.4328) on Interface Gi0/16 AuditSessionID AC1000C30000014543120991
Aug 1 20:32:10: %AUTHMGR-7-RESULT: Authentication result 'success' from
'dot1x' for client (e0db.55e9.4328) on Interface Gi0/16 AuditSessionID
AC1000C30000014543120991
Aug 1 20:32:11: %AUTHMGR-5-SUCCESS: Authorization succeeded for client
(e0db.55e9.4328) on Interface Gi0/16 AuditSessionID AC1000C30000014543120991
Aug 1 20:32:11: %LINK-3-UPDOWN: Interface GigabitEthernet0/16, changed state
to up
Aug 1 20:32:13: %LINEPROTO-5-UPDOWN: Line protocol on Interface
GigabitEthernet0/16, changed state to up
But not setting the VLAN to 18.
In the nodes, I see the machine registered, but the role and unregistration is
blank.
If I manually set the role in the node, it gets applied during 802.1x
authentication, but it is not being delivered by the rule in the authentication
source.
Raddebug shows the correct profile is being used, and my machine auth source is
set in the profile, but the vlan is not being set once 802.1x succeeds.
I'm not sure if somehow it's not using the correct realm? Raddebug only ever
references realm "LOCAL"
I don't know why it's not setting the vlan.
Thanks in advance for your help.
Darryl
Here are my conf
Realm.conf
[root@pf1 conf]# cat realm.conf
[LOCAL]
source=AD-MachineAuth
domain=CoreAD
[CORE]
source=AD-MachineAuth
domain=CoreAD
[CORE.LOCAL]
source=AD-MachineAuth
domain=CoreAD
Domain.conf
[root@pf1 conf]# cat domain.conf
[CoreAD]
ntlm_cache_filter=(&(samAccountName=*)(!(|(lockoutTime=>0)(userAccountControl:1.2.840.113556.1.4.803:=2))))
ntlm_cache=disabled
registration=0
ntlm_cache_expiry=3600
dns_name=CORE.LOCAL
dns_servers=172.16.1.12,172.16.1.92
ou=Computers
bind_pass=
ntlm_cache_on_connection=disabled
bind_dn=
workgroup=CORE
ntlm_cache_batch_one_at_a_time=disabled
sticky_dc=*
ad_server=172.16.1.12
ntlm_cache_batch=disabled
server_name=%h
Profiles.conf
[root@pf1 conf]# cat profiles.conf
[CompanyOwned]
locale=
root_module=CompanyMachines
filter=connection_type:Ethernet-EAP
description=Company owned machines in AD
logo=/common/eclogo.png
sources=AD-MachineAuth
autoregister=enabled
[CompanyUsers]
locale=
filter=
description=user login
sources=AD-Auth
[CompanyProfile]
locale=
root_module=Companypolicy
filter=vlan:2,network:192.168.6.0/24
description=Profile for guest access
logo=/common/eclogo.png
Authentication.conf
...
[AD-MachineAuth]
cache_match=0
basedn=ou=computers-earthcolor,dc=core,dc=local
password=***************
set_access_level_action=
scope=base
email_attribute=mail
usernameattribute=servicePrincipalName
connection_timeout=5
stripped_user_name=no
binddn=core\adbinduser
encryption=ssl
port=636
description=Active Directory AD Machine Authentication
host=172.16.1.12
type=AD
[AD-MachineAuth rule PomeroyMachine]
action0=set_role=PomOffice_18
match=any
class=authentication
action1=set_access_duration=1YF+0D
description=Machine dn Pomeroy
...
________________________________
>>> CONFIDENTIALITY NOTICE <<<
This electronic mail (e-mail) message, including any and/or all attachments, is
for the sole use of the intended recipient(s), and may contain confidential
and/or privileged information, pertaining to business conducted under the
direction and supervision of EarthColor, Inc. All e-mail messages, which may
have been established as expressed views and/or opinions (stated either within
the e-mail message or any of its attachments), are left to the sole
responsibility of that of the sender, and are not necessarily attributed to
EarthColor, Inc. Unauthorized interception, review, use, disclosure or
distribution of any such information contained within this e-mail message
and/or its attachment(s), is(are) strictly prohibited. If you are not the
intended recipient, please contact the sender by replying to this e-mail
message, along with the destruction of all copies of the original e-mail
message (along with any attachments).
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
