Join Log in
Score:0
avatar Server

freeradius and openldap : vlan attribution working with radtest but not with wpa_supplicant

cn flag
user161458

Both of my services freeradius and openldap are on the same server. The schema Freeradius is loaded into openldap.

I configured the radiusProfileDN of a user to link to a group. In this group, I have radiusReplyAttribute set to give the informations of the vlan.

  • When I use the command radtest in local (or from the remote and already authenticated client), I recieve an Access-Accept packet (radius protocol) containing the information for the vlan. A wireshark capture show the information for the vlan is in the packet.
  LDAP + Radius                      LDAP + Radius ----- Switch ----- Client
    <--------                              <-----------------------------
    -------->              or              ----------------------------->
   *vlan info*                                       *vlan info*
  • When I use the tool wpa_supplicant (peap-gtc protocol), I authenticate with success but the client port is not added to the vlan group. A wireshark capture show the Access-Accept packet exchanged between the switch and the Radius server dont have the vlan information in it.
LDAP + Radius ----- Switch ----- Client
  <------------------    <----------
  ------------------>    ---------->
    *no vlan info*      wpa_supplicant

From the log of openldap, the same steps are made for the authentication with radtest or wpa_supplicant :

  1. read access allowed for radiusReplyAttribute on 'mygroup'
  2. result was in cache (radiusReplyAttribute)
  3. send_search_entry exit
  4. send_ldap_result & send_ldap_response

In the ldap server, I tried putting the vlan information directly in the user, or in the already made "variable" for the vlan info but I get the same result.

Do you know where my problem come from ? It seems related to wpa_supplicant using a different protocol than the radtest command and freeradius (maybe I miss a line in the configuration) ?

70
0 + 0
Score:1
avatar Server
cn flag
user161458

I am using the peap-gtc protocol for authentication.

To pass the attribute information in the Access-Accept packet, I had to edit the following freeradius file : mods-enabled/eap.

peap {
    use_tunneled_reply = yes
}

Now the switch port get configured in the corresponding vlan.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.