Hi Fabrice, Excellent advice as always! thank you very much! I now have my users successfully getting assigned VLANs. Unfortunately I'm still stuck on one thing. I can't seem to get my users to automatically redirect to the packetfence captive portal when they connect to the open SSID. If the user manually accesses http://10.2.2.254/captive-portal they can successfully authenticate, and they receive the dynamic VLAN assignment and switch IPs to the new VLAN (where 10.2.2.254 is the local IP of packfence).
To configure my device, I have been following this guide: https://www.packetfence.org/doc/PacketFence_Network_Devices_Configuration_Guide.html#_vlan_enforcement_2 My current unifi configuration is: https://imgur.com/a/IwK9ipZ My questions: 1) Why won't my client redirect? 1) In the guide linked above you have not checked the "apply guest policies (captive portal, guest authentication, access)" checkbox. Is this correct? 2) Do I understand how this works correctly? After the user successfully authenticates with the Open network, they should automatically be "upgraded" to the secure 802.1x network? Thanks again for your help! -Adrian LOG (client connects to open wifi, manually goes to captive portal, logs in and is assigned to correct VLAN): Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] is of status unreg; belongs into registration VLAN (pf::role::getRegistrationRole) Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] (10.2.2.29) Added VLAN 100 to the returned RADIUS Access-Accept (pf::Switch::returnRadiusAccessAccept) Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] handling radius autz request: from switch_ip => (10.2.2.29), connection_type => Wireless-802.11-NoEAP,switch_mac => (74:83:c2:25:e2:d4), mac => [5c:e0:c5:c1:d6:fd], port => 0, username => "5c:e0:c5:c1:d6:fd", ssid => Rook Hotel Unifi (pf::radius::authorize) Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] is of status unreg; belongs into registration VLAN (pf::role::getRegistrationRole) Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] (10.2.2.29) Added VLAN 100 to the returned RADIUS Access-Accept (pf::Switch::returnRadiusAccessAccept) Nov 27 18:08:40 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:40 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:40 radius pfqueue: pfqueue(25543) WARN: [mac:5c:e0:c5:c1:d6:fd] Unable to pull accounting history for device 5c:e0:c5:c1:d6:fd. The history set doesn't exist yet. (pf::accounting_events_history::latest_mac_history) Nov 27 18:08:40 radius pfqueue: pfqueue(25543) WARN: [mac:5c:e0:c5:c1:d6:fd] Unable to pull accounting history for device 5c:e0:c5:c1:d6:fd. The history set doesn't exist yet. (pf::accounting_events_history::latest_mac_history) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found authentication source(s) : 'local' for realm 'null' (pf::config::util::filter_authentication_sources) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Authenticating user using sources : local (captiveportal::PacketFence::DynamicRouting::Module::Authentication::Login::authenticate) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Authentication successful for room906 in source local (SQL) (pf::authentication::authenticate) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Successfully authenticated room906 (captiveportal::PacketFence::DynamicRouting::Module::Authentication::Login::authenticate) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule class. Defaulting to 'authentication' (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule class. Defaulting to 'authentication' (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule class. Defaulting to 'authentication' (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule class. Defaulting to 'authentication' (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(25666) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] No provisioner found for 5c:e0:c5:c1:d6:fd. Continuing. (captiveportal::PacketFence::DynamicRouting::Module::Provisioning::execute_child) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] security_event 1300003 force-closed for 5c:e0:c5:c1:d6:fd (pf::security_event::security_event_force_close) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] locale from the URL is not supported (pf::Portal::Session::getLanguages) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] locale from the URL is not supported (captiveportal::PacketFence::Controller::Root::getLanguages) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found authentication source(s) : 'local' for realm 'null' (pf::config::util::filter_authentication_sources) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Authenticating user using sources : local (captiveportal::PacketFence::DynamicRouting::Module::Authentication::Login::authenticate) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Authentication successful for room906 in source local (SQL) (pf::authentication::authenticate) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Successfully authenticated room906 (captiveportal::PacketFence::DynamicRouting::Module::Authentication::Login::authenticate) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule class. Defaulting to 'authentication' (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule class. Defaulting to 'authentication' (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule class. Defaulting to 'authentication' (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule class. Defaulting to 'authentication' (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching (pf::authentication::match) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session. (Class::MOP::Class:::around) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(25666) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] No provisioner found for 5c:e0:c5:c1:d6:fd. Continuing. (captiveportal::PacketFence::DynamicRouting::Module::Provisioning::execute_child) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] security_event 1300003 force-closed for 5c:e0:c5:c1:d6:fd (pf::security_event::security_event_force_close) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] locale from the URL is not supported (pf::Portal::Session::getLanguages) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] locale from the URL is not supported (captiveportal::PacketFence::Controller::Root::getLanguages) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Releasing device (captiveportal::PacketFence::DynamicRouting::Module::Root::release) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] User default has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] locale from the URL is not supported (pf::Portal::Session::getLanguages) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] re-evaluating access (manage_register called) (pf::enforcement::reevaluate_access) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] VLAN reassignment is forced. (pf::enforcement::_should_we_reassign_vlan) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] switch port is (10.2.2.29) ifIndex 0connection type: WiFi MAC Auth (pf::enforcement::_vlan_reevaluation) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Releasing device (captiveportal::PacketFence::DynamicRouting::Module::Root::release) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] User default has authenticated on the portal. (Class::MOP::Class:::after) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) WARN: [mac:5c:e0:c5:c1:d6:fd] locale from the URL is not supported (pf::Portal::Session::getLanguages) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] re-evaluating access (manage_register called) (pf::enforcement::reevaluate_access) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] VLAN reassignment is forced. (pf::enforcement::_should_we_reassign_vlan) Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633) INFO: [mac:5c:e0:c5:c1:d6:fd] switch port is (10.2.2.29) ifIndex 0connection type: WiFi MAC Auth (pf::enforcement::_vlan_reevaluation) Nov 27 18:08:59 radius pfqueue: pfqueue(27227) INFO: [mac:5c:e0:c5:c1:d6:fd] [5c:e0:c5:c1:d6:fd] DesAssociating mac on switch (10.2.2.29) (pf::api::desAssociate) Nov 27 18:08:59 radius pfqueue: pfqueue(27227) INFO: [mac:5c:e0:c5:c1:d6:fd] [5c:e0:c5:c1:d6:fd] DesAssociating mac on switch (10.2.2.29) (pf::api::desAssociate) Nov 27 18:09:00 radius pfqueue: pfqueue(27227) INFO: [mac:5c:e0:c5:c1:d6:fd] Found site: Default (pf::Switch::Ubiquiti::Unifi::_deauthenticateMacWithHTTP) Nov 27 18:09:00 radius pfqueue: pfqueue(27227) INFO: [mac:5c:e0:c5:c1:d6:fd] Deauth on site: Default (pf::Switch::Ubiquiti::Unifi::_deauthenticateMacWithHTTP) Nov 27 18:09:00 radius pfqueue: pfqueue(27227) INFO: [mac:5c:e0:c5:c1:d6:fd] Switched status on the Unifi controller using command kick-sta (pf::Switch::Ubiquiti::Unifi::_deauthenticateMacWithHTTP) Nov 27 18:09:00 radius pfqueue: pfqueue(27227) INFO: [mac:5c:e0:c5:c1:d6:fd] Found site: Default (pf::Switch::Ubiquiti::Unifi::_deauthenticateMacWithHTTP) Nov 27 18:09:00 radius pfqueue: pfqueue(27227) INFO: [mac:5c:e0:c5:c1:d6:fd] Deauth on site: Default (pf::Switch::Ubiquiti::Unifi::_deauthenticateMacWithHTTP) Nov 27 18:09:00 radius pfqueue: pfqueue(27227) INFO: [mac:5c:e0:c5:c1:d6:fd] Switched status on the Unifi controller using command kick-sta (pf::Switch::Ubiquiti::Unifi::_deauthenticateMacWithHTTP) Nov 27 18:09:01 radius packetfence_httpd.portal: httpd.portal(25666) WARN: [mac:5c:e0:c5:c1:d6:fd] Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Plack/Handler/Apache2.pm line 81. Nov 27 18:09:01 radius packetfence_httpd.portal: httpd.portal(25666) WARN: [mac:5c:e0:c5:c1:d6:fd] Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Plack/Handler/Apache2.pm line 81. Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] handling radius autz request: from switch_ip => (10.2.2.29), connection_type => Wireless-802.11-NoEAP,switch_mac => (74:83:c2:25:e2:d4), mac => [5c:e0:c5:c1:d6:fd], port => 0, username => "5c:e0:c5:c1:d6:fd", ssid => Rook Hotel Unifi (pf::radius::authorize) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] Found authentication source(s) : 'local' for realm 'null' (pf::config::util::filter_authentication_sources) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] Connection type is MAC-AUTH. Getting role from node_info (pf::role::getRegisteredRole) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] Username was defined "5c:e0:c5:c1:d6:fd" - returning role 'room906' (pf::role::getRegisteredRole) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] PID: "room906", Status: reg Returned VLAN: (undefined), Role: room906 (pf::role::fetchRoleForNode) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) WARN: [mac:5c:e0:c5:c1:d6:fd] No parameter room906Vlan found in conf/switches.conf for the switch 10.2.2.29 (pf::Switch::getVlanByName) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] Match rule DynamicVLAN (pf::access_filter::radius::test) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] handling radius autz request: from switch_ip => (10.2.2.29), connection_type => Wireless-802.11-NoEAP,switch_mac => (74:83:c2:25:e2:d4), mac => [5c:e0:c5:c1:d6:fd], port => 0, username => "5c:e0:c5:c1:d6:fd", ssid => Rook Hotel Unifi (pf::radius::authorize) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest (pf::Connection::ProfileFactory::_from_profile) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] Found authentication source(s) : 'local' for realm 'null' (pf::config::util::filter_authentication_sources) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] Connection type is MAC-AUTH. Getting role from node_info (pf::role::getRegisteredRole) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] Username was defined "5c:e0:c5:c1:d6:fd" - returning role 'room906' (pf::role::getRegisteredRole) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] PID: "room906", Status: reg Returned VLAN: (undefined), Role: room906 (pf::role::fetchRoleForNode) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) WARN: [mac:5c:e0:c5:c1:d6:fd] No parameter room906Vlan found in conf/switches.conf for the switch 10.2.2.29 (pf::Switch::getVlanByName) Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO: [mac:5c:e0:c5:c1:d6:fd] Match rule DynamicVLAN (pf::access_filter::radius::test) On Thu, Nov 26, 2020 at 5:03 PM Durand fabrice <[email protected]> wrote: > > Hello Adrian, > > Try that: > > BuildFromMatch($node_info.category,"^room(\d+)$","$1") > > Check in the file conf/radius_filters.conf.example for the attributes > you can use. > > Also for the warning it's normal since the vlan for the room906 is not > define in the switch config. > > To remove this warning you can set the vlan 1 for each room role since > the radius filter will overwrite the answer. (merge_answer=no) > > > Regards > > Fabrice > > > Le 20-11-26 à 19 h 29, Adrian D'Atri-Guiran a écrit : > > Hi Fabrice, > > > > Once again great advice and thank you so much for your help! I have > > imported all the roles, and added the Dynamic VLAN definition to > > radius_filters.conf and it sort of works, but not exactly as intended. > > If I create a new user 'test' and assign it to the role 'room906' it > > will fail to do the dynamic vlan assignment. If I create a user with > > username 'room906' and assign it to the role 'room906', then the > > dynamic vlan assignment does work! I believe that in your code it > > looks at the username instead of the rolename? Is there a way to use > > the role name instead? > > I'm guessing something like: > > BuildFromMatch($node_info.role,"^room(\d+)$","$1") > > But i'm not sure about the correct syntax, etc. > > > > Also there is a WARN "No parameter room906Vlan found in > > conf/switches.conf" even when the dynamic vlan does work, i'm not sure > > if this is important or can just be ignored. > > > > Thanks! > > > > Logs: > > # username test example > > [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest > > (pf::Connection::ProfileFactory::_from_profile) > > [mac:5c:e0:c5:c1:d6:fd] Found authentication source(s) : 'local' for > > realm 'null' (pf::config::util::filter_authentication_sources) > > [mac:5c:e0:c5:c1:d6:fd] Connection type is MAC-AUTH. Getting role from > > node_info (pf::role::getRegisteredRole) > > [mac:5c:e0:c5:c1:d6:fd] Username was defined "5c:e0:c5:c1:d6:fd" - > > returning role 'room906' (pf::role::getRegisteredRole) > > [mac:5c:e0:c5:c1:d6:fd] PID: "test", Status: reg Returned VLAN: > > (undefined), Role: room906 (pf::role::fetchRoleForNode) > > [mac:5c:e0:c5:c1:d6:fd] No parameter room906Vlan found in > > conf/switches.conf for the switch 10.2.2.59 > > (pf::Switch::getVlanByName) > > > > # username room906 example > > INFO: [mac:5c:e0:c5:c1:d6:fd] handling radius autz request: from > > switch_ip => (10.2.2.59), connection_type => > > Wireless-802.11-NoEAP,switch_mac => (74:83:c2:25:e2:d4), mac => > > [5c:e0:c5:c1:d6:fd], port => 0, username => "5c:e0:c5:c1:d6:fd", ssid > > => Rook Hotel Unifi (pf::radius::authorize) > > INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest > > (pf::Connection::ProfileFactory::_from_profile) > > INFO: [mac:5c:e0:c5:c1:d6:fd] Found authentication source(s) : 'local' > > for realm 'null' (pf::config::util::filter_authentication_sources) > > INFO: [mac:5c:e0:c5:c1:d6:fd] Connection type is MAC-AUTH. Getting > > role from node_info (pf::role::getRegisteredRole) > > INFO: [mac:5c:e0:c5:c1:d6:fd] Username was defined "5c:e0:c5:c1:d6:fd" > > - returning role 'room906' (pf::role::getRegisteredRole) > > INFO: [mac:5c:e0:c5:c1:d6:fd] PID: "room906", Status: reg Returned > > VLAN: (undefined), Role: room906 (pf::role::fetchRoleForNode) > > WARN: [mac:5c:e0:c5:c1:d6:fd] No parameter room906Vlan found in > > conf/switches.conf for the switch 10.2.2.59 > > (pf::Switch::getVlanByName) > > INFO: [mac:5c:e0:c5:c1:d6:fd] Match rule DynamicVLAN > > (pf::access_filter::radius::test) > > > > On Wed, Nov 25, 2020 at 6:09 PM Durand fabrice <[email protected]> wrote: > >> Hello Adrian, > >> > >> there is multiples way. > >> > >> First one, fill the roles.conf file: > >> > >> [room1] > >> max_nodes_per_pid=0 > >> notes=Room1 devices > >> > >> [room2] > >> max_nodes_per_pid=0 > >> notes=Room2 devices > >> > >> [room3] > >> max_nodes_per_pid=0 > >> notes=Room3 devices > >> > >> > >> ... > >> > >> Then run addons/upgrade/to-7.0-roles-conf.pl (it will insert them in the > >> db). > >> > >> Next you can check how a user is created from the admin gui (enable dev > >> mode in chrome and check the network tab to see what is the request and > >> what is the payload) > >> > >> > >> Second one (a little bit more advanced) > >> > >> You need to have the users in packetfence , then add this in > >> radius_filters.conf > >> > >> [DynamicVLAN] > >> answer.1=reply:Tunnel-Type = VLAN > >> status=enabled > >> answer.0=reply:Tunnel-Medium-Type = IEEE-802 > >> description=Return VLAN id based on the room number > >> scopes=returnRadiusAccessAccept > >> radius_status=RLM_MODULE_OK > >> merge_answer=no > >> answer.2=reply:Tunnel-Private-Group-Id = > >> ${BuildFromMatch($node_info.pid,"^room(\d+)$","$1")} > >> condition=node_info.pid =~ "room(\\d+)" && node_info.status == "reg" > >> > >> > >> So it mean if the device is reg and the pid is room(digit) then return > >> the vlan id (digit). > >> > >> So per example the device have the pid room101 then packetfence will > >> return the vlan id 101. > >> > >> room102 -> vlan 102 > >> > >> ... > >> > >> I hope it will help. > >> > >> Regards > >> > >> Fabrice > >> > >> > >> Le 20-11-25 à 17 h 47, Adrian D'Atri-Guiran a écrit : > >>> Hi Fabrice, > >>> > >>> This was helpful. I have some small problems with this approach > >>> though. For my building I have 120 rooms. > >>> As I understand, I should add 120 roles -- one for each room. > >>> For each of my access points I should define VLAN ID for each of those > >>> 120 roles. > >>> While this is a bit tedious but not impossible. > >>> > >>> Questions: > >>> 1) I looked at the API to see if there is some way to programatically > >>> create these 120 roles, but there is no method for POST > >>> /api/v1/config/roles. So for bulk role creation this must be done > >>> manually? > >>> > >>> 2) At guest check in, I wish to programmatically generate a new user > >>> and assign them to this role using the API. I looked at endpoint: > >>> POST /api/v1/users and this does allow me to create a user, but the > >>> user has no username, and more importantly, there is no way to assign > >>> a role to this user with the API? > >>> > >>> 3) Is there some way I could use a script or code block to define the > >>> VLAN ID assignment from role? I'm worried that someone will make a > >>> mistake when entering in these VLAN IDs for each of the 120 roles on > >>> each new AP that is installed. > >>> > >>> Thank you, > >>> Adrian > >>> > >>> On Tue, Nov 24, 2020 at 5:57 PM Durand fabrice <[email protected]> wrote: > >>>> Hello Adrian, > >>>> > >>>> create a role for each room (like room101 room102 ...) then in the > >>>> switch config define the vlan id for each roles. > >>>> > >>>> Btw you need to set the correct role for each users. > >>>> > >>>> Regards > >>>> > >>>> Fabrice > >>>> > >>>> > >>>> Le 20-11-22 à 19 h 00, Adrian D'Atri-Guiran a écrit : > >>>>> Hello Fabrice, > >>>>> > >>>>> Thank you, this was immensely helpful. I now have my users > >>>>> authenticating and getting past the captive portal. But I can't > >>>>> figure out how I should assign them a VLAN? where is this setting? > >>>>> My goal is 1 vlan per hotel room, i.e. 1 vlan per login. For example: > >>>>> Room 101 - username 101 - password (set via API at check in) - vlan 101 > >>>>> Room 102 - username 102 - password (set via API at check in) - vlan 102 > >>>>> Room 103 - username 103 - password (set via API at check in) - vlan 103 > >>>>> > >>>>> Please point me in the right direction to accomplish this. > >>>>> Thank you, > >>>>> Adrian > >>>>> > >>>>> On Fri, Nov 20, 2020 at 7:00 PM Durand fabrice via PacketFence-users > >>>>> <[email protected]> wrote: > >>>>>> Hello Adrian, > >>>>>> > >>>>>> this is not the correct approach and it's not really a good idea to use > >>>>>> the local freeradius server as a source. > >>>>>> > >>>>>> What you can do instead is to use the local accounts to authenticate > >>>>>> the > >>>>>> users. > >>>>>> > >>>>>> Like create a new user in packetfence, assign a role and an access > >>>>>> duration. > >>>>>> > >>>>>> On a connection profile with let's say a filter based on the SSID name > >>>>>> add the "local" source. > >>>>>> > >>>>>> So when you will hit the portal, packetfence will instanciate the > >>>>>> correct connection profile and use the local source to authenticate. > >>>>>> > >>>>>> Regards > >>>>>> > >>>>>> Fabrice > >>>>>> > >>>>>> > >>>>>> Le 20-11-20 à 15 h 23, Adrian D'Atri-Guiran via PacketFence-users a > >>>>>> écrit : > >>>>>>> Hello, > >>>>>>> > >>>>>>> I am attempting to set up packetfence 10.2 on Debian 9. My goal is to > >>>>>>> have users authenticate via a captive portal, and have each user > >>>>>>> mapped to a unique and specific VLAN. As far I am aware, the only way > >>>>>>> to accomplish this is via authentication with RADIUS. I would like to > >>>>>>> know if this would be possible using only packetfence as the > >>>>>>> authentication / user manager, if so which authentication source do I > >>>>>>> use? otherwise, if radius is required, please review my problem below. > >>>>>>> > >>>>>>> On /admin/alt#/configuration/sources > >>>>>>> I have added an internal source, RADIUS, in the config for this source > >>>>>>> I have defined the host as 127.0.0.1 and port 18120 and secret. > >>>>>>> (I have also tried 10.2.2.254 as the host, and a wide variety of > >>>>>>> different ports.) > >>>>>>> https://i.imgur.com/SBFPctS.png > >>>>>>> > >>>>>>> In /admin/alt#/configuration/realms > >>>>>>> I have added RADIUS with the following config: > >>>>>>> https://i.imgur.com/0yektXa.png > >>>>>>> > >>>>>>> In /admin/alt#/configuration/interfaces > >>>>>>> I have one interface defined, with daemons `portal` and `radius` > >>>>>>> https://i.imgur.com/Sc1S7V6.png > >>>>>>> > >>>>>>> I have added a user to the top of: > >>>>>>> $ head -n 1 /usr/local/pf/raddb/users > >>>>>>> test Cleartext-Password := "qwerty" > >>>>>>> > >>>>>>> When I direct my computer to 10.2.2.254/captive-portal I receive a > >>>>>>> captive portal, and after checking the box I get the login prompt. > >>>>>>> When I enter in 'test' and 'qwerty' i receive this error in > >>>>>>> /usr/local/pf/logs/packetfence.log: > >>>>>>> ERROR: [mac:68:f7:28:e1:a6:26] Unable to perform RADIUS authentication > >>>>>>> on any server: ERECVFAIL > >>>>>>> (pf::Authentication::Source::RADIUSSource::_handle_radius_request) > >>>>>>> and at the same time I receive no new messages in > >>>>>>> /usr/local/pf/logs/radius.log > >>>>>>> > >>>>>>> I have tried to test using radtest, and at first I was unsuccessful, > >>>>>>> until I changed the radius config > >>>>>>> in:/usr/local/pf/conf/radiusd/auth.conf > >>>>>>> To enable it to bind to a port other than port 0. Note: this feels > >>>>>>> really wrong, should I really have to be changing these configs to get > >>>>>>> Radius working with packetfence? > >>>>>>> listen { > >>>>>>> ipaddr = [% ip %] > >>>>>>> port = 0 > >>>>>>> type = auth > >>>>>>> virtual_server = [% virtual_server %] > >>>>>>> } > >>>>>>> to: > >>>>>>> listen { > >>>>>>> ipaddr = [% ip %] > >>>>>>> port = 18120 > >>>>>>> type = auth > >>>>>>> virtual_server = [% virtual_server %] > >>>>>>> } > >>>>>>> > >>>>>>> After this change I was able to confirm radius was sort of working > >>>>>>> with: > >>>>>>> radtest test qwerty2 10.2.2.254:18120 12 redacted_shared_secret > >>>>>>> I receive: > >>>>>>> Sent Access-Request Id 221 from 0.0.0.0:43344 to 10.2.2.254:18120 > >>>>>>> length 75 > >>>>>>> User-Name = "test2" > >>>>>>> User-Password = "qwerty2" > >>>>>>> NAS-IP-Address = 10.2.2.254 > >>>>>>> NAS-Port = 12 > >>>>>>> Message-Authenticator = 0x00 > >>>>>>> Cleartext-Password = "qwerty2" > >>>>>>> Received Access-Accept Id 221 from 10.2.2.254:18120 to > >>>>>>> 10.2.2.254:43344 length 20 > >>>>>>> > >>>>>>> But the strangest part about this is that I can actually send any > >>>>>>> username/password and get Access-Accept. > >>>>>>> > >>>>>>> Despite the above changes, when I attempt to login via the captive > >>>>>>> portal I receive: > >>>>>>> ERROR: [mac:68:f7:28:e1:a6:26] Unable to perform RADIUS authentication > >>>>>>> on any server: ERECVFAIL > >>>>>>> (pf::Authentication::Source::RADIUSSource::_handle_radius_request) > >>>>>>> > >>>>>>> Thank you for your time, I appreciate it immensely. > >>>>>>> -Adrian > >>>>>>> > >>>>>>> > >>>>>>> _______________________________________________ > >>>>>>> PacketFence-users mailing list > >>>>>>> [email protected] > >>>>>>> https://lists.sourceforge.net/lists/listinfo/packetfence-users > >>>>>> _______________________________________________ > >>>>>> PacketFence-users mailing list > >>>>>> [email protected] > >>>>>> https://lists.sourceforge.net/lists/listinfo/packetfence-users _______________________________________________ PacketFence-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/packetfence-users
