Hello Adrian,
Le 20-11-27 à 18 h 12, Adrian D'Atri-Guiran a écrit :
Hi Fabrice,
Excellent advice as always! thank you very much!
I now have my users successfully getting assigned VLANs.
Unfortunately I'm still stuck on one thing. I can't seem to get my
users to automatically redirect to the packetfence captive portal when
they connect to the open SSID. If the user manually accesses
http://10.2.2.254/captive-portal they can successfully authenticate,
and they receive the dynamic VLAN assignment and switch IPs to the new
VLAN (where 10.2.2.254 is the local IP of packfence).
To configure my device, I have been following this guide:
https://www.packetfence.org/doc/PacketFence_Network_Devices_Configuration_Guide.html#_vlan_enforcement_2
My current unifi configuration is:
https://imgur.com/a/IwK9ipZ
My questions:
1) Why won't my client redirect?
Does this vlan 100 is managed by packetfence ? (dhcp/dns/...)
When you try to ping www.google.ca, does it resolve the ip of the portal ?
1) In the guide linked above you have not checked the "apply guest
policies (captive portal, guest authentication, access)" checkbox. Is
this correct?
Yes, you are doing vlan enforcement so you don't want the ap to forward
you to the portal but you want to land in the reg vlan.
2) Do I understand how this works correctly? After the user
successfully authenticates with the Open network, they should
automatically be "upgraded" to the secure 802.1x network?
Hum not really, you will need to use a provisioner for that.
At the end of the registration the portal will tell you to install/click
on a link in order to configure your device to do 802.1x.
IMO focus first on the open ssid and do the complete registration
process, once done you will think about the provisioner setup.
Last thing, in the log there is no trace about dhcp, so the vlan 100
looks to be managed by something else (who is the dhcp in this vlan ?)
Regards
Fabrice
Thanks again for your help!
-Adrian
LOG (client connects to open wifi, manually goes to captive portal,
logs in and is assigned to correct VLAN):
Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] is of status unreg; belongs into registration
VLAN (pf::role::getRegistrationRole)
Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] (10.2.2.29) Added VLAN 100 to the returned
RADIUS Access-Accept (pf::Switch::returnRadiusAccessAccept)
Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] handling radius autz request: from switch_ip
=> (10.2.2.29), connection_type => Wireless-802.11-NoEAP,switch_mac =>
(74:83:c2:25:e2:d4), mac => [5c:e0:c5:c1:d6:fd], port => 0, username
=> "5c:e0:c5:c1:d6:fd", ssid => Rook Hotel Unifi
(pf::radius::authorize)
Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] is of status unreg; belongs into registration
VLAN (pf::role::getRegistrationRole)
Nov 27 18:07:41 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] (10.2.2.29) Added VLAN 100 to the returned
RADIUS Access-Accept (pf::Switch::returnRadiusAccessAccept)
Nov 27 18:08:40 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:40 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:40 radius pfqueue: pfqueue(25543) WARN:
[mac:5c:e0:c5:c1:d6:fd] Unable to pull accounting history for device
5c:e0:c5:c1:d6:fd. The history set doesn't exist yet.
(pf::accounting_events_history::latest_mac_history)
Nov 27 18:08:40 radius pfqueue: pfqueue(25543) WARN:
[mac:5c:e0:c5:c1:d6:fd] Unable to pull accounting history for device
5c:e0:c5:c1:d6:fd. The history set doesn't exist yet.
(pf::accounting_events_history::latest_mac_history)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found authentication source(s) : 'local'
for realm 'null' (pf::config::util::filter_authentication_sources)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Authenticating user using sources :
local
(captiveportal::PacketFence::DynamicRouting::Module::Authentication::Login::authenticate)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Authentication successful for room906 in
source local (SQL) (pf::authentication::authenticate)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Successfully authenticated room906
(captiveportal::PacketFence::DynamicRouting::Module::Authentication::Login::authenticate)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule
class. Defaulting to 'authentication' (pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching
(pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule
class. Defaulting to 'authentication' (pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching
(pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule
class. Defaulting to 'authentication' (pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching
(pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule
class. Defaulting to 'authentication' (pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching
(pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(25666)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] No provisioner found for
5c:e0:c5:c1:d6:fd. Continuing.
(captiveportal::PacketFence::DynamicRouting::Module::Provisioning::execute_child)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] security_event 1300003 force-closed for
5c:e0:c5:c1:d6:fd (pf::security_event::security_event_force_close)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] locale from the URL is not supported
(pf::Portal::Session::getLanguages)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] locale from the URL is not supported
(captiveportal::PacketFence::Controller::Root::getLanguages)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found authentication source(s) : 'local'
for realm 'null' (pf::config::util::filter_authentication_sources)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Authenticating user using sources :
local
(captiveportal::PacketFence::DynamicRouting::Module::Authentication::Login::authenticate)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Authentication successful for room906 in
source local (SQL) (pf::authentication::authenticate)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Successfully authenticated room906
(captiveportal::PacketFence::DynamicRouting::Module::Authentication::Login::authenticate)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule
class. Defaulting to 'authentication' (pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching
(pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule
class. Defaulting to 'authentication' (pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching
(pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule
class. Defaulting to 'authentication' (pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching
(pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] Calling match with empty/invalid rule
class. Defaulting to 'authentication' (pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Using sources local for matching
(pf::authentication::match)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found source local in session.
(Class::MOP::Class:::around)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(25666)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] No provisioner found for
5c:e0:c5:c1:d6:fd. Continuing.
(captiveportal::PacketFence::DynamicRouting::Module::Provisioning::execute_child)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] User room906 has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] security_event 1300003 force-closed for
5c:e0:c5:c1:d6:fd (pf::security_event::security_event_force_close)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(27174)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] locale from the URL is not supported
(pf::Portal::Session::getLanguages)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] locale from the URL is not supported
(captiveportal::PacketFence::Controller::Root::getLanguages)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Releasing device
(captiveportal::PacketFence::DynamicRouting::Module::Root::release)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] User default has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] locale from the URL is not supported
(pf::Portal::Session::getLanguages)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] re-evaluating access (manage_register
called) (pf::enforcement::reevaluate_access)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] VLAN reassignment is forced.
(pf::enforcement::_should_we_reassign_vlan)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] switch port is (10.2.2.29) ifIndex
0connection type: WiFi MAC Auth (pf::enforcement::_vlan_reevaluation)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Releasing device
(captiveportal::PacketFence::DynamicRouting::Module::Root::release)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] User default has authenticated on the
portal. (Class::MOP::Class:::after)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
WARN: [mac:5c:e0:c5:c1:d6:fd] locale from the URL is not supported
(pf::Portal::Session::getLanguages)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] re-evaluating access (manage_register
called) (pf::enforcement::reevaluate_access)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] VLAN reassignment is forced.
(pf::enforcement::_should_we_reassign_vlan)
Nov 27 18:08:58 radius packetfence_httpd.portal: httpd.portal(26633)
INFO: [mac:5c:e0:c5:c1:d6:fd] switch port is (10.2.2.29) ifIndex
0connection type: WiFi MAC Auth (pf::enforcement::_vlan_reevaluation)
Nov 27 18:08:59 radius pfqueue: pfqueue(27227) INFO:
[mac:5c:e0:c5:c1:d6:fd] [5c:e0:c5:c1:d6:fd] DesAssociating mac on
switch (10.2.2.29) (pf::api::desAssociate)
Nov 27 18:08:59 radius pfqueue: pfqueue(27227) INFO:
[mac:5c:e0:c5:c1:d6:fd] [5c:e0:c5:c1:d6:fd] DesAssociating mac on
switch (10.2.2.29) (pf::api::desAssociate)
Nov 27 18:09:00 radius pfqueue: pfqueue(27227) INFO:
[mac:5c:e0:c5:c1:d6:fd] Found site: Default
(pf::Switch::Ubiquiti::Unifi::_deauthenticateMacWithHTTP)
Nov 27 18:09:00 radius pfqueue: pfqueue(27227) INFO:
[mac:5c:e0:c5:c1:d6:fd] Deauth on site: Default
(pf::Switch::Ubiquiti::Unifi::_deauthenticateMacWithHTTP)
Nov 27 18:09:00 radius pfqueue: pfqueue(27227) INFO:
[mac:5c:e0:c5:c1:d6:fd] Switched status on the Unifi controller using
command kick-sta
(pf::Switch::Ubiquiti::Unifi::_deauthenticateMacWithHTTP)
Nov 27 18:09:00 radius pfqueue: pfqueue(27227) INFO:
[mac:5c:e0:c5:c1:d6:fd] Found site: Default
(pf::Switch::Ubiquiti::Unifi::_deauthenticateMacWithHTTP)
Nov 27 18:09:00 radius pfqueue: pfqueue(27227) INFO:
[mac:5c:e0:c5:c1:d6:fd] Deauth on site: Default
(pf::Switch::Ubiquiti::Unifi::_deauthenticateMacWithHTTP)
Nov 27 18:09:00 radius pfqueue: pfqueue(27227) INFO:
[mac:5c:e0:c5:c1:d6:fd] Switched status on the Unifi controller using
command kick-sta
(pf::Switch::Ubiquiti::Unifi::_deauthenticateMacWithHTTP)
Nov 27 18:09:01 radius packetfence_httpd.portal: httpd.portal(25666)
WARN: [mac:5c:e0:c5:c1:d6:fd] Use of uninitialized value in
concatenation (.) or string at
/usr/share/perl5/Plack/Handler/Apache2.pm line 81.
Nov 27 18:09:01 radius packetfence_httpd.portal: httpd.portal(25666)
WARN: [mac:5c:e0:c5:c1:d6:fd] Use of uninitialized value in
concatenation (.) or string at
/usr/share/perl5/Plack/Handler/Apache2.pm line 81.
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] handling radius autz request: from switch_ip
=> (10.2.2.29), connection_type => Wireless-802.11-NoEAP,switch_mac =>
(74:83:c2:25:e2:d4), mac => [5c:e0:c5:c1:d6:fd], port => 0, username
=> "5c:e0:c5:c1:d6:fd", ssid => Rook Hotel Unifi
(pf::radius::authorize)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] Found authentication source(s) : 'local' for
realm 'null' (pf::config::util::filter_authentication_sources)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] Connection type is MAC-AUTH. Getting role from
node_info (pf::role::getRegisteredRole)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] Username was defined "5c:e0:c5:c1:d6:fd" -
returning role 'room906' (pf::role::getRegisteredRole)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] PID: "room906", Status: reg Returned VLAN:
(undefined), Role: room906 (pf::role::fetchRoleForNode)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) WARN:
[mac:5c:e0:c5:c1:d6:fd] No parameter room906Vlan found in
conf/switches.conf for the switch 10.2.2.29
(pf::Switch::getVlanByName)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] Match rule DynamicVLAN
(pf::access_filter::radius::test)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] handling radius autz request: from switch_ip
=> (10.2.2.29), connection_type => Wireless-802.11-NoEAP,switch_mac =>
(74:83:c2:25:e2:d4), mac => [5c:e0:c5:c1:d6:fd], port => 0, username
=> "5c:e0:c5:c1:d6:fd", ssid => Rook Hotel Unifi
(pf::radius::authorize)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] Found authentication source(s) : 'local' for
realm 'null' (pf::config::util::filter_authentication_sources)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] Connection type is MAC-AUTH. Getting role from
node_info (pf::role::getRegisteredRole)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] Username was defined "5c:e0:c5:c1:d6:fd" -
returning role 'room906' (pf::role::getRegisteredRole)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] PID: "room906", Status: reg Returned VLAN:
(undefined), Role: room906 (pf::role::fetchRoleForNode)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) WARN:
[mac:5c:e0:c5:c1:d6:fd] No parameter room906Vlan found in
conf/switches.conf for the switch 10.2.2.29
(pf::Switch::getVlanByName)
Nov 27 18:09:05 radius packetfence_httpd.aaa: httpd.aaa(1446) INFO:
[mac:5c:e0:c5:c1:d6:fd] Match rule DynamicVLAN
(pf::access_filter::radius::test)
On Thu, Nov 26, 2020 at 5:03 PM Durand fabrice <[email protected]> wrote:
Hello Adrian,
Try that:
BuildFromMatch($node_info.category,"^room(\d+)$","$1")
Check in the file conf/radius_filters.conf.example for the attributes
you can use.
Also for the warning it's normal since the vlan for the room906 is not
define in the switch config.
To remove this warning you can set the vlan 1 for each room role since
the radius filter will overwrite the answer. (merge_answer=no)
Regards
Fabrice
Le 20-11-26 à 19 h 29, Adrian D'Atri-Guiran a écrit :
Hi Fabrice,
Once again great advice and thank you so much for your help! I have
imported all the roles, and added the Dynamic VLAN definition to
radius_filters.conf and it sort of works, but not exactly as intended.
If I create a new user 'test' and assign it to the role 'room906' it
will fail to do the dynamic vlan assignment. If I create a user with
username 'room906' and assign it to the role 'room906', then the
dynamic vlan assignment does work! I believe that in your code it
looks at the username instead of the rolename? Is there a way to use
the role name instead?
I'm guessing something like:
BuildFromMatch($node_info.role,"^room(\d+)$","$1")
But i'm not sure about the correct syntax, etc.
Also there is a WARN "No parameter room906Vlan found in
conf/switches.conf" even when the dynamic vlan does work, i'm not sure
if this is important or can just be ignored.
Thanks!
Logs:
# username test example
[mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
[mac:5c:e0:c5:c1:d6:fd] Found authentication source(s) : 'local' for
realm 'null' (pf::config::util::filter_authentication_sources)
[mac:5c:e0:c5:c1:d6:fd] Connection type is MAC-AUTH. Getting role from
node_info (pf::role::getRegisteredRole)
[mac:5c:e0:c5:c1:d6:fd] Username was defined "5c:e0:c5:c1:d6:fd" -
returning role 'room906' (pf::role::getRegisteredRole)
[mac:5c:e0:c5:c1:d6:fd] PID: "test", Status: reg Returned VLAN:
(undefined), Role: room906 (pf::role::fetchRoleForNode)
[mac:5c:e0:c5:c1:d6:fd] No parameter room906Vlan found in
conf/switches.conf for the switch 10.2.2.59
(pf::Switch::getVlanByName)
# username room906 example
INFO: [mac:5c:e0:c5:c1:d6:fd] handling radius autz request: from
switch_ip => (10.2.2.59), connection_type =>
Wireless-802.11-NoEAP,switch_mac => (74:83:c2:25:e2:d4), mac =>
[5c:e0:c5:c1:d6:fd], port => 0, username => "5c:e0:c5:c1:d6:fd", ssid
=> Rook Hotel Unifi (pf::radius::authorize)
INFO: [mac:5c:e0:c5:c1:d6:fd] Instantiate profile RookHotelGuest
(pf::Connection::ProfileFactory::_from_profile)
INFO: [mac:5c:e0:c5:c1:d6:fd] Found authentication source(s) : 'local'
for realm 'null' (pf::config::util::filter_authentication_sources)
INFO: [mac:5c:e0:c5:c1:d6:fd] Connection type is MAC-AUTH. Getting
role from node_info (pf::role::getRegisteredRole)
INFO: [mac:5c:e0:c5:c1:d6:fd] Username was defined "5c:e0:c5:c1:d6:fd"
- returning role 'room906' (pf::role::getRegisteredRole)
INFO: [mac:5c:e0:c5:c1:d6:fd] PID: "room906", Status: reg Returned
VLAN: (undefined), Role: room906 (pf::role::fetchRoleForNode)
WARN: [mac:5c:e0:c5:c1:d6:fd] No parameter room906Vlan found in
conf/switches.conf for the switch 10.2.2.59
(pf::Switch::getVlanByName)
INFO: [mac:5c:e0:c5:c1:d6:fd] Match rule DynamicVLAN
(pf::access_filter::radius::test)
On Wed, Nov 25, 2020 at 6:09 PM Durand fabrice <[email protected]> wrote:
Hello Adrian,
there is multiples way.
First one, fill the roles.conf file:
[room1]
max_nodes_per_pid=0
notes=Room1 devices
[room2]
max_nodes_per_pid=0
notes=Room2 devices
[room3]
max_nodes_per_pid=0
notes=Room3 devices
...
Then run addons/upgrade/to-7.0-roles-conf.pl (it will insert them in the
db).
Next you can check how a user is created from the admin gui (enable dev
mode in chrome and check the network tab to see what is the request and
what is the payload)
Second one (a little bit more advanced)
You need to have the users in packetfence , then add this in
radius_filters.conf
[DynamicVLAN]
answer.1=reply:Tunnel-Type = VLAN
status=enabled
answer.0=reply:Tunnel-Medium-Type = IEEE-802
description=Return VLAN id based on the room number
scopes=returnRadiusAccessAccept
radius_status=RLM_MODULE_OK
merge_answer=no
answer.2=reply:Tunnel-Private-Group-Id =
${BuildFromMatch($node_info.pid,"^room(\d+)$","$1")}
condition=node_info.pid =~ "room(\\d+)" && node_info.status == "reg"
So it mean if the device is reg and the pid is room(digit) then return
the vlan id (digit).
So per example the device have the pid room101 then packetfence will
return the vlan id 101.
room102 -> vlan 102
...
I hope it will help.
Regards
Fabrice
Le 20-11-25 à 17 h 47, Adrian D'Atri-Guiran a écrit :
Hi Fabrice,
This was helpful. I have some small problems with this approach
though. For my building I have 120 rooms.
As I understand, I should add 120 roles -- one for each room.
For each of my access points I should define VLAN ID for each of those
120 roles.
While this is a bit tedious but not impossible.
Questions:
1) I looked at the API to see if there is some way to programatically
create these 120 roles, but there is no method for POST
/api/v1/config/roles. So for bulk role creation this must be done
manually?
2) At guest check in, I wish to programmatically generate a new user
and assign them to this role using the API. I looked at endpoint:
POST /api/v1/users and this does allow me to create a user, but the
user has no username, and more importantly, there is no way to assign
a role to this user with the API?
3) Is there some way I could use a script or code block to define the
VLAN ID assignment from role? I'm worried that someone will make a
mistake when entering in these VLAN IDs for each of the 120 roles on
each new AP that is installed.
Thank you,
Adrian
On Tue, Nov 24, 2020 at 5:57 PM Durand fabrice <[email protected]> wrote:
Hello Adrian,
create a role for each room (like room101 room102 ...) then in the
switch config define the vlan id for each roles.
Btw you need to set the correct role for each users.
Regards
Fabrice
Le 20-11-22 à 19 h 00, Adrian D'Atri-Guiran a écrit :
Hello Fabrice,
Thank you, this was immensely helpful. I now have my users
authenticating and getting past the captive portal. But I can't
figure out how I should assign them a VLAN? where is this setting?
My goal is 1 vlan per hotel room, i.e. 1 vlan per login. For example:
Room 101 - username 101 - password (set via API at check in) - vlan 101
Room 102 - username 102 - password (set via API at check in) - vlan 102
Room 103 - username 103 - password (set via API at check in) - vlan 103
Please point me in the right direction to accomplish this.
Thank you,
Adrian
On Fri, Nov 20, 2020 at 7:00 PM Durand fabrice via PacketFence-users
<[email protected]> wrote:
Hello Adrian,
this is not the correct approach and it's not really a good idea to use
the local freeradius server as a source.
What you can do instead is to use the local accounts to authenticate the
users.
Like create a new user in packetfence, assign a role and an access duration.
On a connection profile with let's say a filter based on the SSID name
add the "local" source.
So when you will hit the portal, packetfence will instanciate the
correct connection profile and use the local source to authenticate.
Regards
Fabrice
Le 20-11-20 à 15 h 23, Adrian D'Atri-Guiran via PacketFence-users a écrit :
Hello,
I am attempting to set up packetfence 10.2 on Debian 9. My goal is to
have users authenticate via a captive portal, and have each user
mapped to a unique and specific VLAN. As far I am aware, the only way
to accomplish this is via authentication with RADIUS. I would like to
know if this would be possible using only packetfence as the
authentication / user manager, if so which authentication source do I
use? otherwise, if radius is required, please review my problem below.
On /admin/alt#/configuration/sources
I have added an internal source, RADIUS, in the config for this source
I have defined the host as 127.0.0.1 and port 18120 and secret.
(I have also tried 10.2.2.254 as the host, and a wide variety of
different ports.)
https://i.imgur.com/SBFPctS.png
In /admin/alt#/configuration/realms
I have added RADIUS with the following config: https://i.imgur.com/0yektXa.png
In /admin/alt#/configuration/interfaces
I have one interface defined, with daemons `portal` and `radius`
https://i.imgur.com/Sc1S7V6.png
I have added a user to the top of:
$ head -n 1 /usr/local/pf/raddb/users
test Cleartext-Password := "qwerty"
When I direct my computer to 10.2.2.254/captive-portal I receive a
captive portal, and after checking the box I get the login prompt.
When I enter in 'test' and 'qwerty' i receive this error in
/usr/local/pf/logs/packetfence.log:
ERROR: [mac:68:f7:28:e1:a6:26] Unable to perform RADIUS authentication
on any server: ERECVFAIL
(pf::Authentication::Source::RADIUSSource::_handle_radius_request)
and at the same time I receive no new messages in /usr/local/pf/logs/radius.log
I have tried to test using radtest, and at first I was unsuccessful,
until I changed the radius config
in:/usr/local/pf/conf/radiusd/auth.conf
To enable it to bind to a port other than port 0. Note: this feels
really wrong, should I really have to be changing these configs to get
Radius working with packetfence?
listen {
ipaddr = [% ip %]
port = 0
type = auth
virtual_server = [% virtual_server %]
}
to:
listen {
ipaddr = [% ip %]
port = 18120
type = auth
virtual_server = [% virtual_server %]
}
After this change I was able to confirm radius was sort of working with:
radtest test qwerty2 10.2.2.254:18120 12 redacted_shared_secret
I receive:
Sent Access-Request Id 221 from 0.0.0.0:43344 to 10.2.2.254:18120 length 75
User-Name = "test2"
User-Password = "qwerty2"
NAS-IP-Address = 10.2.2.254
NAS-Port = 12
Message-Authenticator = 0x00
Cleartext-Password = "qwerty2"
Received Access-Accept Id 221 from 10.2.2.254:18120 to
10.2.2.254:43344 length 20
But the strangest part about this is that I can actually send any
username/password and get Access-Accept.
Despite the above changes, when I attempt to login via the captive
portal I receive:
ERROR: [mac:68:f7:28:e1:a6:26] Unable to perform RADIUS authentication
on any server: ERECVFAIL
(pf::Authentication::Source::RADIUSSource::_handle_radius_request)
Thank you for your time, I appreciate it immensely.
-Adrian
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
