That sounds perfect, thanks!
Also, is there a way to stop PacketFence from looking for "nodes" on it's
local network? In the nodes I see all the devices that are on the same
subnet as the PacketFence server, but it just clutters is up because they
are all wired devices.
On Fri, Oct 13, 2017 at 9:01 AM, Durand fabrice via PacketFence-users <
[email protected]> wrote:
> Hello Matt,
>
> yes of course it's something simple to achieve with PacketFence.
>
> You have multiples solutions to do that but the easiest is to set -1 for
> the registration vlan.
>
> So when a device will try to connect and the status is unreg then
> packetfence will return Access Reject.
>
> Regards
>
> Fabrice
>
>
>
>
> Le 2017-10-13 à 08:52, Matt Fogleman via PacketFence-users a écrit :
>
> So currently we have a server running FreeRADIUS that a previous staff
> member stood up, and then created a php web app to manage the Mac addresses
> within the MySQL database. We use this for just simple Mac authentication
> for our one wireless network. The Aruba controller then points to the
> FreeRADIUS server and checks if the client trying to authenticate is in the
> database, and will either allow it to connect or not.
>
> Is there something similar that I can do with PacketFence? Just worried
> something will go wrong with this php site and no one really has the
> programming experience to maintain it.
>
> On Thu, Oct 12, 2017 at 12:26 PM, Sallee, Jake via PacketFence-users <
> [email protected]> wrote:
>
>> Matt:
>>
>>
>> To elaborate on Fabrice's statements jut a bit:
>>
>>
>> The RADIUS portion of PF can be thought of as just the mechanism PF uses
>> to talk to the controllers / APs / Switches.
>>
>>
>> All the logic of who and what devices get what role is defined in PF and
>> those roles should correspond with some type of established network based
>> method of controlling access.
>>
>>
>> In our instance we use VLans and internal firewalls.
>>
>>
>> When a user authenticates the role they are assigned in PF triggers the
>> RADIUS server to respond to the AP with a VLan assignment for that host,
>> that vlan has established rules concerning where hosts on the subnet can
>> and cannot go on the network which are enforced via our internal firewalls.
>>
>>
>> There are other ways you can do it but this is how we do it and my gut
>> feeling is it is very similar to how must people deploy PF.
>>
>>
>> PF will not return an ACCESS DENY except under special circumstances,
>> most of the time you don't want access deny anyway. Typically when you
>> want to deny a user access to network resources, you want to isolate them.
>>
>>
>> Isolation provides the ability to push the user onto a network subnet
>> where you can better control their access and allow for self-remediation,
>> if you want.
>>
>>
>> There are corner cases where outright rejecting the user is what you
>> want, and I am just a stranger on the Internet who knows nothing about your
>> specific requirements ... so you can take my comments with a proverbial
>> grain of salt, YMMV, etc.
>>
>>
>> Hope that helps, please feel free to post back to the list with any
>> problems you have. If I can help and I have time I'll respond.
>>
>>
>> Jake Sallee
>> Godfather of Bandwidth
>> System Engineer
>> University of Mary Hardin-Baylor
>> WWW.UMHB.EDU
>>
>> 900 College St.
>> Belton, Texas
>> 76513
>>
>> Fone: 254-295-4658
>> Phax: 254-295-4221
>> ________________________________
>> From: Fabrice Durand via PacketFence-users <[email protected]
>> eforge.net>
>> Sent: Thursday, October 12, 2017 10:30 AM
>> To: [email protected]
>> Cc: Fabrice Durand
>> Subject: Re: [PacketFence-users] PacketFence FreeRADIUS only configuration
>>
>>
>> Hello Matt,
>>
>> with mac auth packetfence return by default Accept but the
>> vlan_id/Acl/Role is different based on the status of the device.
>>
>> Let say if a device is unreg then you probably want to return Accept with
>> an acl name that will deny the access to the network and when you set the
>> device reg with a role then you probably want to Accept too by with an acl
>> name that will allow the device on the network.
>>
>> On the opposite when you do 802.1x then if the username and password is
>> correct then PacketFence will return Accept but if you use a wrong username
>> and password the return will be Deny.
>>
>> Also to debug when freeradius run, go in /usr/local/pf and do raddebug -f
>> var/run/radius.sock -t 3000
>>
>> Regards
>> Fabrice
>>
>> Le 2017-10-12 à 10:47, Matt Fogleman via PacketFence-users a écrit :
>> I'm really new to both FreeRADIUS and PacketFence, what I am trying to do
>> is just get a simple Mac auth configuration up for our wireless network. I
>> installed PacketFence with the new RADIUS only option on RHEL7, I added our
>> wireless controller in the Configuration > Switches section and gave it the
>> RADIUS key, and also configured the same thing on our wireless controller.
>>
>> It seems to be accepting connections, but it is just accepting
>> everything. I added the Mac address of a laptop in the "Nodes" section,
>> and saw in Auditing that it sent back an Accept message. But then I
>> deleted the Mac address out of "Nodes" and tried again and it sent the
>> Accept message again. So I tried a different device that I hadn't added
>> before, and it got accepted as well.
>>
>> Is there somewhere I have to configure the conditions for it to send back
>> a Reject message?
>>
>> I'm also getting an error when trying to start debugging.
>> Refusing to start with libssl version OpenSSL 1.0.1e-fips 11 Feb 2013
>> 0x1000105f (1.0.1e release) (in range 1.0.1 release - 1.0.1t rele)
>> Has anyone else encountered this?
>>
>> --
>> Matt Fogleman
>> Network Technician
>> Unionville-Chadds Ford School District
>> (o) (610) 347-0970
>>
>>
>>
>> ------------------------------------------------------------
>> ------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org<https://linkprote
>> ct.cudasvc.com/url?a=https://Slashdot.org&c=E,1,ZuIlSdKDzcG
>> 9MeyeaZU0g_sTRetVx7ox44Zillzgd_QYh06SXQux6EOVD7OUQ6ne2oMulBK
>> KIHthE_VKdDiXvKOPE4e-qSJHNIOSM4iGDs3T18cV561JX3QJ&typo=1>!
>> http://sdm.link/slashdot<https://linkprotect.cudasvc.com/url
>> ?a=http://sdm.link/slashdot&c=E,1,LZg9XqvjBmhirgrEMOjDbHOW3D
>> xyqvZDn9XS0Mt5VdZtZAqXzoN2JFvHu4zD-eMlSG7_JzIxqcFkpjna14uexy
>> LCsAdzZJ6MHLuC3mY,&typo=1>
>>
>>
>>
>> _______________________________________________
>> PacketFence-users mailing list
>> [email protected]<mailto:PacketFence-
>> [email protected]>
>> https://lists.sourceforge.net/lists/listinfo/packetfence-users
>>
>>
>>
>> --
>> Fabrice Durand
>> [email protected]<mailto:[email protected]> :: +1.514.447.4918 (x135)
>> :: www.inverse.ca<https://linkprotect.cudasvc.com/url?a=http://
>> www.inverse.ca&c=E,1,uYjcnRPETfowTOn17pZlwJbrD2E2fo5JpIGoi20
>> 0YDy_2nDgQIAZQx2U80UfMFQDcDONkhzydqUdWCMCLpOoqLJfq9iPH3ZTMxG
>> WeS1dK5U,&typo=1>
>> Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu<https://li
>> nkprotect.cudasvc.com/url?a=http://www.sogo.nu&c=E,1,Gm7t-it
>> AvsZQsxUp8W9RQOiJaqglSV_Dj0jqDiIJWt5LLeIwWrQ-H9o63PhiPS2TJgf
>> 5OwKYLXSpsa1Uvddwby2kC-ffgwy5DjcqdYqAlOH6LyTeZqY,&typo=1>) and
>> PacketFence (http://packetfence.org<https://linkprotect.cudasvc.com/url?
>> a=http://packetfence.org&c=E,1,pe1X9i4Y8D9gUO2QsxvdXkhQ0P2nV
>> nDm-njBcQdr0gJcsKML5MYeCC3RRCfo-Mxku3gHyo1-89TAYX-xhnfl8Gj_g
>> aXoYvXIrJ_MweZpOuDC&typo=1>)
>>
>> ------------------------------------------------------------
>> ------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>> _______________________________________________
>> PacketFence-users mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/packetfence-users
>>
>
>
>
> --
> *Matt Fogleman*
> Network Technician
> Unionville-Chadds Ford School District
> *(o)** (610) 347-0970 <(610)%20347-0970>*
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
>
>
> _______________________________________________
> PacketFence-users mailing
> [email protected]https://lists.sourceforge.net/lists/listinfo/packetfence-users
>
>
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> PacketFence-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/packetfence-users
>
>
--
*Matt Fogleman*
Network Technician
Unionville-Chadds Ford School District
*(o)** (610) 347-0970*
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
