Hi All,
Greetings!
We recently stood up a PacketFence NAC pilot (v15.0.0 on Rocky Linux)
covering wired 802.1X/PEAP, MAC Authentication Bypass, and a captive
portal flow, integrated with Active Directory for role-based VLAN
assignment on a Cisco Catalyst 2960S. The core flow is working, but we
ran into several recurring issues during setup that I'd appreciate the
community's input on, in case others have hit the same things.
1) Authentication rule matching is strictly first-match, not best-match
Within a single authentication source (AD, in our case), we have rules
like "memberOf Finance group -> role FINDEPT" and "memberOf IT group ->
role ITDEPT". We found that when a user matched more than one rule's
condition, PacketFence always applied whichever rule appears first (by
position), not the most specific match, with no visible warning that
multiple rules matched. This caused a real mix-up during testing where a
Finance-group user was silently assigned the IT role because the IT rule
happened to be listed first. Is this expected/documented behavior, and
is there a recommended way to make rule matching more deterministic
(e.g. mutually exclusive rule conditions, or a way to flag when a user
matches more than one rule)? We'd also like confirmation that reordering
rules must be done via the admin UI drag-and-drop (to correctly persist
priority), since editing authentication.conf by hand didn't reliably
reflect the same order the UI would have produced.
2) iptables rules disappearing on "Other" type interfaces
We created a management-only VLAN interface (not Registration/Isolation
type) so PacketFence could reach our switch for RADIUS/CoA. We found
that PacketFence never auto-generates iptables ACCEPT rules for RADIUS
(1812/1813) or CoA (3799) on "Other" type interfaces the way it does for
Registration/Isolation. We had to add these manually, and they kept
getting wiped whenever config reloaded or certain services restarted. Is
there a supported way to have PacketFence persist/manage firewall rules
for RADIUS traffic on a non-Registration/Isolation interface, rather
than us maintaining them outside PacketFence's control?
3) httpd.portal container being killed unexpectedly
Mid-session, our httpd.portal Docker container was killed (log showed an
explicit SIGKILL and "No such container" message from a wrapper script),
causing captive portal 503s, while other containers (httpd.webservices,
etc.) stayed healthy. We didn't find a clear trigger in our own actions.
Has anyone seen this pattern, and is there a known cause (Docker cleanup
routine, resource limit, watchdog) we should be looking at?
4) Consumer-grade wireless AP and dynamic VLAN assignment
We attempted WPA2-Enterprise (PEAP) authentication via a consumer
TP-Link router configured as an AP. RADIUS authentication itself worked
correctly, but the AP does not appear to support RADIUS
CoA/Disconnect-Message (RFC 3576), so PacketFence's dynamic VLAN
reassignment after role evaluation never applied - we saw repeated
"Unable to perform RADIUS Disconnect-Request: Timeout" in the logs. We
ended up designing around this with a fixed VLAN per SSID instead. Is
there a known list of consumer/prosumer AP hardware that reliably
supports CoA for anyone considering a similar low-cost wireless pilot?
5) Guest VLAN with a Registration-type interface never getting real
internet access
We set up a guest VLAN as a "Registration" type interface in
PacketFence, and predictably it stayed walled-garden (DNS hijack to the
portal) even after guest role/auth succeeded. We understand this is by
design for Registration/Isolation interfaces. For a guest VLAN that
should get real internet after authenticating, is the recommended
pattern to always use an "Other" type interface with a separate
router/firewall as the gateway (similar to a production VLAN), rather
than trying to get PacketFence itself to route/NAT that traffic?
6) Role file (roles.conf) losing entries after renaming roles via the
admin UI
We renamed a couple of roles via the GUI mid-project and later found
that roles.conf only contained the renamed roles - two other roles we
still actively use in switches.conf and authentication rules (guest,
isolation) had disappeared from roles.conf entirely. Is this expected
behavior when renaming roles through the UI, and is there a safer
workflow to rename roles without orphaning others?
Any pointers, known issues, or links to relevant tickets/docs would be
much appreciated. Happy to share more logs/configs if useful for
troubleshooting.
Thanks in advance,
--
*Vincent Oliver*
System Support Engineer | Linux Enthusiast | Transitioning into DevOps
[email protected]
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
