802.1x on pc5424. Client didn't obtain vlan

Question

Hello

I try to setup freeradius 2 with pc5424 to dynamic change/assign vlan from radius. Client passed the authentication but he didn't obtain any vlan. I change some settings : switchport mode genera/access but it didn't help. As a client i usein test windows xp with eap/peap and mschapv2

Thx for any clue

on pc5424 i have:

8021x_test# sh running-config
interface range ethernet g(10,12)
spanning-tree portfast

interface ethernet g10
switchport mode general

vlan database
vlan 7,57-60,107

dot1x system-auth-control
interface range ethernet g(10,12)
dot1x re-authentication

interface range ethernet g(10,12)
dot1x port-control auto

hostname 8021x_test
radius-server host 10.1.1.245 key secretpass

aaa authentication dot1x default radius

On freeradius i have:

test2 Cleartext-Password := "test2"
        Service-Type = Framed-User,
        Tunnel-Type = 13,
        Tunnel-Medium-Type = 6,
        Tunnel-Private-Group-ID = "0058",

8021x_test# sh version
SW version    2.0.0.41 ( date 23-Sep-2009 time 15:48:40 )
Boot version    2.0.0.0 ( date 12-Nov-2008 time 12:56:52 )
HW version    00.00.02

logs from switch:

8021x_test# 01-Jan-2000 01:27:21 %LINK-W-Down: g10
01-Jan-2000 01:27:24 %SEC-W-PORTUNAUTHORIZED: Port g10 is unAuthorized
01-Jan-2000 01:27:24 %STP-W-PORTSTATUS: g10: STP status Forwarding
01-Jan-2000 01:27:24 %LINK-I-Up: g10
01-Jan-2000 01:27:40 %SEC-I-PORTAUTHORIZED: Port g10 is Authorized
01-Jan-2000 01:27:40 %SEC-I-SUPPLICANTAUTHORIZED: MAC 00:0a:e4:ba:eb:4a is authorized on port g10

logs from radius:

Wed Sep 15 17:53:03 2010 : Auth: Login OK: [test2] (from client client1 port 0 via TLS tunnel)
Wed Sep 15 17:53:03 2010 : Auth: Login OK: [test2] (from client client1 port 10 cli 00-0A-E4-BA-EB-4A)

popo1970 · Answer

I try this on pc 6248, sw3.2.0.7, only 802.1x with freeradius2

and on console i got:

radius_api.c(1058) 654 %% RADIUS: radiusAccountingNamedStart(): Could not get atleast one named Server'

UNKN[126427680]: dot1x_radius.c(1128) 655 %% dot1xRadiusAccountingStart: error calling radiusAccountingStart, ifIndex=10

and i didn't get any vlan...

There is some bug in Powerconnect or something else ?

thx for help

regards

popo

bh1633 · Answer

I do not believe dynamic vlan assignment via RADIUS is a feature on the 54xx.

On the 62xx, post your configuration file. I do not have experience with freeradius, but here is some information for setting up IAS.

Configure Windows IAS Server:

Configuration
dot1x Password := dot1x
dot1xVlan Password := dot1x
Service-Type = Framed;
Tunnel-Medium-Type = 802;
Tunnel-Pvt-Group-ID = 2 (VLAN)
Tunnel-Type = Virtual LANs (VLAN)
'MAC Address' Password := 'MAC Address' where 'MAC Adress' = Client's MAC address
Service-Type = Framed;
Tunnel-Medium-Type = 802;
Tunnel-Pvt-Group-ID = 2 (VLAN)
Tunnel-Type = Virtual LANs (VLAN)
}
client x.x.x.x /24 {
secret = testing
shortname = testnet
}

popo1970 · Answer

Now i tested on pc6248

sh run

!System Description "Powerconnect 6248, 3.2.0.7, VxWorks 6.5"

vlan database
vlan 7,58,107
vlan routing 58 1
exit

dot1x system-auth-control
aaa authentication dot1x default radius
radius-server host auth 10.138.1.245
name "Default-RADIUS-Server"
key "secretpass"
exit

interface ethernet 1/g10
spanning-tree portfast
switchport mode general
exit
!

interface ethernet 1/g48
switchport mode trunk

switchport trunk allowed vlan add 7,58,107
dot1x port-control force-authorized
exit
!

on console i got:

UNKN[126427680]: radius_api.c(1058) 768 %% RADIUS: radiusAccountingNamedStart(): Could not get atleast one named Server'

UNKN[126427680]: dot1x_radius.c(1128) 769 %% dot1xRadiusAccountingStart: error calling radiusAccountingStart, ifIndex=10

TRAPMGR[152288784]: traputil.c(611) 770 %% 1/0/10 status is authorized

from freeradius2 i got:

++[eap] returns ok
Login OK: [ftest2] (from client client1 port 10 cli 00:0a:e4:ba:eb:4a)
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 180 to 10.138.1.146 port 49152
        Service-Type = Framed-User
        Tunnel-Type:0 = VLAN
        Tunnel-Medium-Type:0 = IEEE-802
        Tunnel-Private-Group-Id:0 = "0058"
        User-Name = "test2"
        MS-MPPE-Recv-Key = 0xfcb8e8beff0033d61849064be5ebd7e4cf4435fb8c049169e32371c795f4c1e6
        MS-MPPE-Send-Key = 0x2fd4cc5c5ee6a0354e58b5d93ad44e9bc4c205e146004af9367fd2c2553d5696
        EAP-Message = 0x030a0004
        Message-Authenticator = 0x00000000000000000000000000000000
Finished request 9.
Going to the next request

There is no diffrence between pc 5424 i pc 6248 in this case...

thx for help

Networking General

802.1x on pc5424. Client didn't obtain vlan

Was this post helpful?