Great, thank you for all your help!
On Fri, Oct 13, 2017 at 9:19 AM, Durand fabrice via PacketFence-users <
[email protected]> wrote:
> You can just stop pfdhcplistener.
>
> Le 2017-10-13 à 09:06, Matt Fogleman via PacketFence-users a écrit :
>
> That sounds perfect, thanks!
>
> Also, is there a way to stop PacketFence from looking for "nodes" on it's
> local network? In the nodes I see all the devices that are on the same
> subnet as the PacketFence server, but it just clutters is up because they
> are all wired devices.
>
> On Fri, Oct 13, 2017 at 9:01 AM, Durand fabrice via PacketFence-users <
> [email protected]> wrote:
>
>> Hello Matt,
>>
>> yes of course it's something simple to achieve with PacketFence.
>>
>> You have multiples solutions to do that but the easiest is to set -1 for
>> the registration vlan.
>>
>> So when a device will try to connect and the status is unreg then
>> packetfence will return Access Reject.
>>
>> Regards
>>
>> Fabrice
>>
>>
>>
>>
>> Le 2017-10-13 à 08:52, Matt Fogleman via PacketFence-users a écrit :
>>
>> So currently we have a server running FreeRADIUS that a previous staff
>> member stood up, and then created a php web app to manage the Mac addresses
>> within the MySQL database. We use this for just simple Mac authentication
>> for our one wireless network. The Aruba controller then points to the
>> FreeRADIUS server and checks if the client trying to authenticate is in the
>> database, and will either allow it to connect or not.
>>
>> Is there something similar that I can do with PacketFence? Just worried
>> something will go wrong with this php site and no one really has the
>> programming experience to maintain it.
>>
>> On Thu, Oct 12, 2017 at 12:26 PM, Sallee, Jake via PacketFence-users <
>> [email protected]> wrote:
>>
>>> Matt:
>>>
>>>
>>> To elaborate on Fabrice's statements jut a bit:
>>>
>>>
>>> The RADIUS portion of PF can be thought of as just the mechanism PF uses
>>> to talk to the controllers / APs / Switches.
>>>
>>>
>>> All the logic of who and what devices get what role is defined in PF and
>>> those roles should correspond with some type of established network based
>>> method of controlling access.
>>>
>>>
>>> In our instance we use VLans and internal firewalls.
>>>
>>>
>>> When a user authenticates the role they are assigned in PF triggers the
>>> RADIUS server to respond to the AP with a VLan assignment for that host,
>>> that vlan has established rules concerning where hosts on the subnet can
>>> and cannot go on the network which are enforced via our internal firewalls.
>>>
>>>
>>> There are other ways you can do it but this is how we do it and my gut
>>> feeling is it is very similar to how must people deploy PF.
>>>
>>>
>>> PF will not return an ACCESS DENY except under special circumstances,
>>> most of the time you don't want access deny anyway. Typically when you
>>> want to deny a user access to network resources, you want to isolate them.
>>>
>>>
>>> Isolation provides the ability to push the user onto a network subnet
>>> where you can better control their access and allow for self-remediation,
>>> if you want.
>>>
>>>
>>> There are corner cases where outright rejecting the user is what you
>>> want, and I am just a stranger on the Internet who knows nothing about your
>>> specific requirements ... so you can take my comments with a proverbial
>>> grain of salt, YMMV, etc.
>>>
>>>
>>> Hope that helps, please feel free to post back to the list with any
>>> problems you have. If I can help and I have time I'll respond.
>>>
>>>
>>> Jake Sallee
>>> Godfather of Bandwidth
>>> System Engineer
>>> University of Mary Hardin-Baylor
>>> WWW.UMHB.EDU
>>>
>>> 900 College St.
>>> Belton, Texas
>>> 76513
>>>
>>> Fone: 254-295-4658
>>> Phax: 254-295-4221
>>> ________________________________
>>> From: Fabrice Durand via PacketFence-users <
>>> [email protected]>
>>> Sent: Thursday, October 12, 2017 10:30 AM
>>> To: [email protected]
>>> Cc: Fabrice Durand
>>> Subject: Re: [PacketFence-users] PacketFence FreeRADIUS only
>>> configuration
>>>
>>>
>>> Hello Matt,
>>>
>>> with mac auth packetfence return by default Accept but the
>>> vlan_id/Acl/Role is different based on the status of the device.
>>>
>>> Let say if a device is unreg then you probably want to return Accept
>>> with an acl name that will deny the access to the network and when you set
>>> the device reg with a role then you probably want to Accept too by with an
>>> acl name that will allow the device on the network.
>>>
>>> On the opposite when you do 802.1x then if the username and password is
>>> correct then PacketFence will return Accept but if you use a wrong username
>>> and password the return will be Deny.
>>>
>>> Also to debug when freeradius run, go in /usr/local/pf and do raddebug
>>> -f var/run/radius.sock -t 3000
>>>
>>> Regards
>>> Fabrice
>>>
>>> Le 2017-10-12 à 10:47, Matt Fogleman via PacketFence-users a écrit :
>>> I'm really new to both FreeRADIUS and PacketFence, what I am trying to
>>> do is just get a simple Mac auth configuration up for our wireless
>>> network. I installed PacketFence with the new RADIUS only option on RHEL7,
>>> I added our wireless controller in the Configuration > Switches section and
>>> gave it the RADIUS key, and also configured the same thing on our wireless
>>> controller.
>>>
>>> It seems to be accepting connections, but it is just accepting
>>> everything. I added the Mac address of a laptop in the "Nodes" section,
>>> and saw in Auditing that it sent back an Accept message. But then I
>>> deleted the Mac address out of "Nodes" and tried again and it sent the
>>> Accept message again. So I tried a different device that I hadn't added
>>> before, and it got accepted as well.
>>>
>>> Is there somewhere I have to configure the conditions for it to send
>>> back a Reject message?
>>>
>>> I'm also getting an error when trying to start debugging.
>>> Refusing to start with libssl version OpenSSL 1.0.1e-fips 11 Feb 2013
>>> 0x1000105f (1.0.1e release) (in range 1.0.1 release - 1.0.1t rele)
>>> Has anyone else encountered this?
>>>
>>> --
>>> Matt Fogleman
>>> Network Technician
>>> Unionville-Chadds Ford School District
>>> (o) (610) 347-0970
>>>
>>>
>>>
>>> ------------------------------------------------------------
>>> ------------------
>>> Check out the vibrant tech community on one of the world's most
>>> engaging tech sites, Slashdot.org<https://linkprote
>>> ct.cudasvc.com/url?a=https://Slashdot.org&c=E,1,ZuIlSdKDzcG9
>>> MeyeaZU0g_sTRetVx7ox44Zillzgd_QYh06SXQux6EOVD7OUQ6ne2oMulBKK
>>> IHthE_VKdDiXvKOPE4e-qSJHNIOSM4iGDs3T18cV561JX3QJ&typo=1>!
>>> http://sdm.link/slashdot<https://linkprotect.cudasvc.com/url
>>> ?a=http://sdm.link/slashdot&c=E,1,LZg9XqvjBmhirgrEMOjDbHOW3D
>>> xyqvZDn9XS0Mt5VdZtZAqXzoN2JFvHu4zD-eMlSG7_JzIxqcFkpjna14uexy
>>> LCsAdzZJ6MHLuC3mY,&typo=1>
>>>
>>>
>>>
>>> _______________________________________________
>>> PacketFence-users mailing list
>>> [email protected]<mailto:PacketFence-u
>>> [email protected]>
>>> https://lists.sourceforge.net/lists/listinfo/packetfence-users
>>>
>>>
>>>
>>> --
>>> Fabrice Durand
>>> [email protected]<mailto:[email protected]> :: +1.514.447.4918
>>> (x135) :: www.inverse.ca<https://linkprotect.cudasvc.com/url?a=http://
>>> www.inverse.ca&c=E,1,uYjcnRPETfowTOn17pZlwJbrD2E2fo5JpIGoi20
>>> 0YDy_2nDgQIAZQx2U80UfMFQDcDONkhzydqUdWCMCLpOoqLJfq9iPH3ZTMxG
>>> WeS1dK5U,&typo=1>
>>> Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu<https://li
>>> nkprotect.cudasvc.com/url?a=http://www.sogo.nu&c=E,1,Gm7t-it
>>> AvsZQsxUp8W9RQOiJaqglSV_Dj0jqDiIJWt5LLeIwWrQ-H9o63PhiPS2TJgf
>>> 5OwKYLXSpsa1Uvddwby2kC-ffgwy5DjcqdYqAlOH6LyTeZqY,&typo=1>) and
>>> PacketFence (http://packetfence.org<https://linkprotect.cudasvc.com/url?
>>> a=http://packetfence.org&c=E,1,pe1X9i4Y8D9gUO2QsxvdXkhQ0P2nV
>>> nDm-njBcQdr0gJcsKML5MYeCC3RRCfo-Mxku3gHyo1-89TAYX-xhnfl8Gj_g
>>> aXoYvXIrJ_MweZpOuDC&typo=1>)
>>>
>>> ------------------------------------------------------------
>>> ------------------
>>> Check out the vibrant tech community on one of the world's most
>>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>>> _______________________________________________
>>> PacketFence-users mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/packetfence-users
>>>
>>
>>
>>
>> --
>> *Matt Fogleman*
>> Network Technician
>> Unionville-Chadds Ford School District
>> *(o)** (610) 347-0970 <%28610%29%20347-0970>*
>>
>>
>> ------------------------------------------------------------------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>>
>>
>>
>> _______________________________________________
>> PacketFence-users mailing
>> [email protected]https://lists.sourceforge.net/lists/listinfo/packetfence-users
>>
>>
>>
>> ------------------------------------------------------------
>> ------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>> _______________________________________________
>> PacketFence-users mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/packetfence-users
>>
>>
>
>
> --
> *Matt Fogleman*
> Network Technician
> Unionville-Chadds Ford School District
> *(o)** (610) 347-0970 <(610)%20347-0970>*
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
>
>
> _______________________________________________
> PacketFence-users mailing
> [email protected]https://lists.sourceforge.net/lists/listinfo/packetfence-users
>
>
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> PacketFence-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/packetfence-users
>
>
--
*Matt Fogleman*
Network Technician
Unionville-Chadds Ford School District
*(o)** (610) 347-0970*
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
