Port authentication with freeradius 802.1x and Powerconnect 2824

Question

Hi,

I configured a Powerconnect 2824 to authorize the interface g1 with RADIUS server (freeradius), but the server is not receiving any auth request when I connect any device to port.

The server is reacheable from the switch (teste with ping) and the port is correct (1812). I have changed the server to log any request and configured the MAC address of one device to auth.

When I try the request from a test client (NTRadPing) the request is logged correctly, with Access-Reject or Access-Accept.

Interface g1 from 2824 Config:

Admin Interface Control: Auto
Current Interface Control: Unauthorized
Authentication Type: 802.1x & MAC
Dynamic VLAN Assignment: Enable
Guest VLAN: Enable
Periodic Reauthentication: Enable

RADIUS log:

Wed Oct 9 15:02:32 2013 : Info: Loaded virtual server inner-tunnel
Wed Oct 9 15:02:32 2013 : Info: Loaded virtual server
Wed Oct 9 15:02:32 2013 : Info: Ready to process requests.

Log after NTRadPing:

Wed Oct 9 15:22:21 2013 : Auth: Login incorrect (rlm_pap: CLEAR TEXT password check failed): [testing] (from client 10.20/24 port 0)
Wed Oct 9 15:49:03 2013 : Auth: Login OK: [testing] (from client 10.20/24 port 0)
Wed Oct 9 16:14:54 2013 : Auth: Login incorrect (rlm_pap: CLEAR TEXT password check failed): [testing] (from client 10.20/24 port 0)

marceloalmeida · Answer

Hello DanielI removed the VLAN configuration to reduce the number of variables.The results I got: a computer with windows XP without the services of 802.1X authentication does not send any message. When you enable the service, the OS asks for the password to connect (I'm not making any check with certified yet).What I expect is that, if the client is not compatible 802.1x, authentication is done via MAC address. This is important for devices such as media converters and printers.Even forcing the MAC authentication only, no request is not sent until service 802.1x is enabled on the client. freeradius users: e8039a421722 Auth-Type := 'EAP', Cleartext-Password := e8039a421722 testing Auth-Type := 'EAP', Cleartext-Password := 'password' 90a4deef20a8 Auth-Type := 'EAP', Cleartext-Password := 90a4deef20a8 5cf8a1c7fe60 Auth-Type := 'EAP', Cleartext-Password := 5cf8a1c7fe60 14d64d252234 Auth-Type := 'EAP', Cleartext-Password := 14d64d252234 Log freeradius: Thu Oct 10 15:02:35 2013 : Info: Loaded virtual server inner-tunnelThu Oct 10 15:02:35 2013 : Info: Loaded virtual server Thu Oct 10 15:02:35 2013 : Info: Ready to process requests. Thu Oct 10 15:02:36 2013 : Error: rlm_eap: No EAP session matching the State variable. Thu Oct 10 15:02:36 2013 : Auth: Login incorrect: [14d64d252234/ ] (from client 10.20/24 port 1 cli 14-D6-4D-25-22-34) Thu Oct 10 15:02:38 2013 : Auth: Login OK: [14d64d252234/ ] (from client 10.20/24 port 1 cli 14-D6-4D-25-22-34) Thu Oct 10 15:03:51 2013 : Auth: Login OK: [90a4deef20a8/ ] (from client 10.20/24 port 1 cli 90-A4-DE-EF-20-A8)

marceloalmeida · Answer

on freeradius users file:

e8039a421722: MAC of Wired WinXP computer
90a4deef20a8: MAC of Wireless WinXP computer
5cf8a1c7fe60: MAC of RS232xEthernet converter
14d64d252234: MAC of DLink Access Point

I have authorized a Android phone via MAC Address succefully also. The AP requesting authorization only after a client request also, either via wireless or the wired network.

mo_naved · Answer

Dear All,

I am working on the project 802.1x authentication on Freeradius , My sql on Centos 6.4 and Cisco Switch. After the configuration of eap.cnf, radiusd.conf users etc I have sucessfully able to login from the Client to netwrok, but only on his vlan. But i want to 802.1x user Base authentication with VLAN Assingment. mean my port will be access port and any user of any vlan can login from the port and radius assing only his vlan.

I am new for Radius server but i was search and found to add entry at etc/raddb/users

"test3"         Cleartext-Password := "test3"
                Tunnal-Type = VLAN,
                Tunnel-Medium-Type = IEEE-802,
                Tunnnel-Private-Group-ID = "111"
After add this entry and try to restart radiusd it goes failed, I have add only this entry and only in this files,

Can any body tell me waht will be configuration of the users or i need to changes some others files.

Naved

marceloalmeida · Answer

Hi Naved,

I have used the guides from www.freeradius.org to install the server and assign the VLANs. On my switch, DELL 2848, is mandatory the create of VLANs before RADIUS can assign the corretc one. Other thing: the switch is configured for integer or string assign?

This is the config I used, my switch is configured for integer assign:

testing Auth-Type := "EAP", Cleartext-Password := "password"
Tunnel-Type = VLAN,
Tunnel-Medium-Type = IEEE-802,
Tunnel-Private-Group-Id = 10

90a4deef20a8 Auth-Type := "EAP", Cleartext-Password := 90a4deef20a8
Tunnel-Type = VLAN,
Tunnel-Medium-Type = IEEE-802,
Tunnel-Private-Group-Id = 10

mo_naved · Answer

I have found there was some mistek in language. Now Service is starting but VLAN is not assing. can any body tell me what is the configuration of 802.1x user base vlan assingment. Naved

mo_naved · Answer

Thanks ,,

I am not trying MAC auth, I am trying user base auth which is belong a specfic vlan suppos,

Naved belong from VLAN 1

and Kazmi beloong VLAN 2

so both user can connect from a port of a switch, in that case my port is not belonging any specfic vlan. I have already create this network in windows enviroment now i am trying it in centos.

And above issue has been sloved after adding above detail my user still not going in the vlan.

Naved

21hertz · Answer

I am trying to setup MAC Auth with a Dell N2048/N2024.

Its working with our current Cisco-switches but not Dell's (we are evaluating them atm).

Dell seems to not be able to recieve PAP messages, only EAP. Which our FreeRADIUS server is not setup to do.

Is it possible to setup PAP instead of EAP when using MAB in Dell switches??

Networking General

Port authentication with freeradius 802.1x and Powerconnect 2824

Was this post helpful?