[PacketFence-users] Failed to join domain

2020-01-05 Thread Christian Hillebrand via PacketFence-users
Hi,

I am new to packetfence and currently trying to setup packetfence to work as
a VLAN enforcement and radius authenticationServer.
I worked through the installation documentation and everything went fine so
far.
However when trying to join my AD domain I am getting the Error:

Joining  domain failed. Failed to join domain: failed to
find DC for domain  - Undetermined error.

I first suspected that I am not getting any DNS responses by my AD DNS.
However a quick nslookup successfully returned correct DNS entries.
The entries which I tested are:
_msdcs. 
_ldap._tcp.pdc._msdcs.
_ldap._tcp.gc._msdcs.
_ldap._tcp.dc._msdcs.
_kerberos._tcp.dc._msdcs.

._msdcs.

After some research I tried to join the domain manually by executing:
net ads join -U Administrator
However this also returned with an error:

Host is not configured as a member server.
Invalid configuration. Exiting
Failed to join domain: This operation is only allowed for the PDC of
the domain.

So after researching a bit I checked that my Server is known by my DC, which
is the case.
I also checked that both system have the correct time and installed and
configured ntp on my packetfence machine.
However this did not resolve any of my issues.
Here my current setup:

Firewall/Router:
pfSense ( just a basic configuration to provide my VLAN's )
hostname:   pfsense
Version:2.4.4-RELEASE-p3
IP in Management VLAN: ^10.0.1.1

NAS with DC:
QNAP ts-432XU
Hostname:   nas0
Firmware:   4.4.1.1146 build 20191206
IP: 10.0.1.101 (VLAN 101 Management) &
10.0.0.101 (VLAN 100)

My Users are in the main Users CN, the Computers are in the main "Computers"
CN, I did not configure any additional OU's

packetfence:
Debian  4.9.0-11-amd-64
Hostname:   nac0
IP Management:  10.0.1.2 ( in all my VLAN's pfSense is assigned to
the second IP )
IP Registration:10.0.253.2
IP Isolation:   10.0.254.2
...

AD Domain settings in packetfence:
Workgroup:   (without tld)
DNS name of this domain:
This server's name: %h
Active Directory server:nas0.
DNS server(s):  10.0.1.101
OU: Computers
Ntlm2 only: false
Allow on registration:  false

So what am I missing? Is packetfence searching for any additional DNS
entries to connect to the DC?
I tried joining the domain with realmd which worked, so I am not sure where
I am doing something wrong...
Thanks!

Best regards,
Christian




___
PacketFence-users mailing list
PacketFence-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/packetfence-users


[PacketFence-users] Failed to join domain

2020-01-05 Thread Christian Hillebrand via PacketFence-users
Hi,

I am new to packetfence and currently trying to setup packetfence to work as
a VLAN enforcement and radius authenticationServer.
I worked through the installation documentation and everything went fine so
far.
However when trying to join my AD domain I am getting the Error:

Joining  domain failed. Failed to join domain: failed to
find DC for domain  - Undetermined error.

I first suspected that I am not getting any DNS responses by my AD DNS.
However a quick nslookup successfully returned correct DNS entries.
The entries which I tested are:
_msdcs. 
_ldap._tcp.pdc._msdcs.
_ldap._tcp.gc._msdcs.
_ldap._tcp.dc._msdcs.
_kerberos._tcp.dc._msdcs.

._msdcs.

After some research I tried to join the domain manually by executing:
net ads join -U Administrator
However this also returned with an error:

Host is not configured as a member server.
Invalid configuration. Exiting
Failed to join domain: This operation is only allowed for the PDC of
the domain.

So after researching a bit I checked that my Server is known by my DC, which
is the case.
I also checked that both system have the correct time and installed and
configured ntp on my packetfence machine.
However this did not resolve any of my issues.
Here my current setup:

Firewall/Router:
pfSense ( just a basic configuration to provide my VLAN's )
hostname:   pfsense
Version:2.4.4-RELEASE-p3
IP in Management VLAN: ^10.0.1.1

NAS with DC:
QNAP ts-432XU
Hostname:   nas0
Firmware:   4.4.1.1146 build 20191206
IP: 10.0.1.101 (VLAN 101 Management) &
10.0.0.101 (VLAN 100)

My Users are in the main Users CN, the Computers are in the main "Computers"
CN, I did not configure any additional OU's

packetfence:
Debian  4.9.0-11-amd-64
Hostname:   nac0
IP Management:  10.0.1.2 ( in all my VLAN's pfSense is assigned to
the second IP )
IP Registration:10.0.253.2
IP Isolation:   10.0.254.2
...

AD Domain settings in packetfence:
Workgroup:   (without tld)
DNS name of this domain:
This server's name: %h
Active Directory server:nas0.
DNS server(s):  10.0.1.101
OU: Computers
Ntlm2 only: false
Allow on registration:  false

So what am I missing? Is packetfence searching for any additional DNS
entries to connect to the DC?
I tried joining the domain with realmd which worked, so I am not sure where
I am doing something wrong...
Thanks!

Best regards,
Christian




___
PacketFence-users mailing list
PacketFence-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/packetfence-users


Re: [PacketFence-users] Failed to join domain

2020-01-07 Thread Christian Hillebrand via PacketFence-users
Hi,
I just checked the settings:
The command " ip route get 10.0.1.101" returns:
10.0.1.101 dev ens192 src 10.0.1.2

I checked if ip forwarding is activated by executing sysctl net.ipv4.ip_forward 
which returned:
net.ipv4.ip_forward = 1
so ip forwarding is activated at the moment.

Additionally here a quick overview of my network interfaces:
NameIP/Mask VLAN (name) Type
ens192  10.0.1.2/24 101 management  Management
ens224.10   10.1.0.2/16 10 executive User   none
ens224.20   10.2.0.2/16 20 usersnone
ens224.30   10.3.0.2/16 30 guests   none
ens224.200  10.0.200.2/24   200 registrationregistration
ens224.201  10.0.201.2/24   201 isolation   isolation

Packetfence is running as a virtual machine on an ESXi host.
Ens192 is connected to the virtual switch and sharing the port with esxi.
The Hardware port on this virtual switch connected to a tagged port on my 
switch, so VLAN 101 is native here.
Ens224 is also connected to a virtual switch, but does not share the hardware.

-Ursprüngliche Nachricht-
Von: Durand fabrice via PacketFence-users 
 
Gesendet: Sonntag, 5. Januar 2020 22:41
An: packetfence-users@lists.sourceforge.net
Cc: Durand fabrice 
Betreff: Re: [PacketFence-users] Failed to join domain

Hello Christian,

can you try to see if the following command return the mgmt interface ?

ip route get 10.0.1.101

Also can you check if ip_forwarding is enabled on the packetfence server ?

Regards

Fabrice

Le 20-01-05 à 06 h 05, Christian Hillebrand via PacketFence-users a écrit :
> Hi,
>
> I am new to packetfence and currently trying to setup packetfence to 
> work as a VLAN enforcement and radius authenticationServer.
> I worked through the installation documentation and everything went 
> fine so far.
> However when trying to join my AD domain I am getting the Error:
>
>   Joining  domain failed. Failed to join domain: failed to find 
> DC for domain  - Undetermined error.
>
> I first suspected that I am not getting any DNS responses by my AD DNS.
> However a quick nslookup successfully returned correct DNS entries.
> The entries which I tested are:
>   _msdcs.
>   _ldap._tcp.pdc._msdcs.
>   _ldap._tcp.gc._msdcs.
>   _ldap._tcp.dc._msdcs.
>   _kerberos._tcp.dc._msdcs.
>   
>   ._msdcs.
>
> After some research I tried to join the domain manually by executing:
>   net ads join -U Administrator
> However this also returned with an error:
>
>   Host is not configured as a member server.
>   Invalid configuration. Exiting
>   Failed to join domain: This operation is only allowed for the PDC of 
> the domain.
>
> So after researching a bit I checked that my Server is known by my DC, 
> which is the case.
> I also checked that both system have the correct time and installed 
> and configured ntp on my packetfence machine.
> However this did not resolve any of my issues.
> Here my current setup:
>
> Firewall/Router:
> pfSense ( just a basic configuration to provide my VLAN's )
> hostname: pfsense
> Version:  2.4.4-RELEASE-p3
> IP in Management VLAN: ^  10.0.1.1
>
> NAS with DC:
> QNAP ts-432XU
> Hostname: nas0
> Firmware: 4.4.1.1146 build 20191206
> IP:   10.0.1.101 (VLAN 101 Management) &
> 10.0.0.101 (VLAN 100)
>
> My Users are in the main Users CN, the Computers are in the main "Computers"
> CN, I did not configure any additional OU's
>
> packetfence:
> Debian4.9.0-11-amd-64
> Hostname: nac0
> IP Management:10.0.1.2 ( in all my VLAN's pfSense is assigned 
> to
> the second IP )
> IP Registration:  10.0.253.2
> IP Isolation: 10.0.254.2
> ...
>
> AD Domain settings in packetfence:
> Workgroup: (without tld)
> DNS name of this domain:  
> This server's name:   %h
> Active Directory server:  nas0.
> DNS server(s):10.0.1.101
> OU:   Computers
> Ntlm2 only:   false
> Allow on registration:false
>
> So what am I missing? Is packetfence searching for any additional DNS 
> entries to connect to the DC?
> I tried joining the domain with realmd which worked, so I am not sure 
> where I am doing something wrong...
> Thanks!
>
> Best regards,
> Christian
>
>
>
>
> ___
> PacketFence-users mailing list
> PacketFence-users@lists.sourceforge.net
> https://lists.sourceforge.net/li

Re: [PacketFence-users] Failed to join domain

2020-01-13 Thread Christian Hillebrand via PacketFence-users
Hi,
In the Hope to solve my issue I just downloaded and configured the ZEN. I 
believed I may have missed something during the installation ore messed 
something up while installing.
However I am running into the same issue.
I configured the ZEN to work only with one “physical” network interface and 
configured my management interface as a VLAN.

To be honest I don’t really know how to troubleshoot this at this point.
Does anybody have good suggestions? 

Regards
Christian 

> Am 07.01.2020 um 22:26 schrieb Christian Hillebrand via PacketFence-users 
> :

> 
> Hi,
> I just checked the settings:
> The command " ip route get 10.0.1.101" returns:
> 10.0.1.101 dev ens192 src 10.0.1.2
> 
> I checked if ip forwarding is activated by executing sysctl 
> net.ipv4.ip_forward which returned:
> net.ipv4.ip_forward = 1
> so ip forwarding is activated at the moment.
> 
> Additionally here a quick overview of my network interfaces:
> NameIP/MaskVLAN (name)Type
> ens19210.0.1.2/24101 managementManagement
> ens224.1010.1.0.2/1610 executive Usernone
> ens224.2010.2.0.2/1620 usersnone
> ens224.3010.3.0.2/1630 guestsnone
> ens224.20010.0.200.2/24200 registrationregistration
> ens224.20110.0.201.2/24201 isolationisolation
> 
> Packetfence is running as a virtual machine on an ESXi host.
> Ens192 is connected to the virtual switch and sharing the port with esxi.
> The Hardware port on this virtual switch connected to a tagged port on my 
> switch, so VLAN 101 is native here.
> Ens224 is also connected to a virtual switch, but does not share the hardware.
> 
> -Ursprüngliche Nachricht-
> Von: Durand fabrice via PacketFence-users 
> 
> Gesendet: Sonntag, 5. Januar 2020 22:41
> An: packetfence-users@lists.sourceforge.net
> Cc: Durand fabrice 
> Betreff: Re: [PacketFence-users] Failed to join domain
> 
> Hello Christian,
> 
> can you try to see if the following command return the mgmt interface ?
> 
> ip route get 10.0.1.101
> 
> Also can you check if ip_forwarding is enabled on the packetfence server ?
> 
> Regards
> 
> Fabrice
> 
>> Le 20-01-05 à 06 h 05, Christian Hillebrand via PacketFence-users a écrit :
>> Hi,
>> 
>> I am new to packetfence and currently trying to setup packetfence to 
>> work as a VLAN enforcement and radius authenticationServer.
>> I worked through the installation documentation and everything went 
>> fine so far.
>> However when trying to join my AD domain I am getting the Error:
>> 
>>Joining  domain failed. Failed to join domain: failed to find 
>> DC for domain  - Undetermined error.
>> 
>> I first suspected that I am not getting any DNS responses by my AD DNS.
>> However a quick nslookup successfully returned correct DNS entries.
>> The entries which I tested are:
>>_msdcs.
>>_ldap._tcp.pdc._msdcs.
>>_ldap._tcp.gc._msdcs.
>>_ldap._tcp.dc._msdcs.
>>_kerberos._tcp.dc._msdcs.
>>
>>._msdcs.
>> 
>> After some research I tried to join the domain manually by executing:
>>net ads join -U Administrator
>> However this also returned with an error:
>> 
>>Host is not configured as a member server.
>>Invalid configuration. Exiting
>>Failed to join domain: This operation is only allowed for the PDC of 
>> the domain.
>> 
>> So after researching a bit I checked that my Server is known by my DC, 
>> which is the case.
>> I also checked that both system have the correct time and installed 
>> and configured ntp on my packetfence machine.
>> However this did not resolve any of my issues.
>> Here my current setup:
>> 
>> Firewall/Router:
>> pfSense ( just a basic configuration to provide my VLAN's )
>> hostname:pfsense
>> Version:2.4.4-RELEASE-p3
>> IP in Management VLAN: ^10.0.1.1
>> 
>> NAS with DC:
>> QNAP ts-432XU
>> Hostname:nas0
>> Firmware:4.4.1.1146 build 20191206
>> IP:10.0.1.101 (VLAN 101 Management) &
>> 10.0.0.101 (VLAN 100)
>> 
>> My Users are in the main Users CN, the Computers are in the main "Computers"
>> CN, I did not configure any additional OU's
>> 
>> packetfence:
>> Debian4.9.0-11-amd-64
>> Hostname:nac0
>> IP Management:10.0.1.2 ( in all my VLAN's pfSense is assigned to
>> the second IP )
>> IP Registration:10.0.253.2
>> IP Isolation:10.0.254.2
>> ...
>

Re: [PacketFence-users] Failed to join domain

2020-01-25 Thread Christian Hillebrand via PacketFence-users
Hi,
unfortunately I just found enough time to check your suggestions:
I added a static route to direct traffic from 169.254.0.0/30 to my pf
machine (10.0.1.2).
I tried to find my dc but with no luck.
When enabling the debug mode I could see that I am getting the correct DNS
entries back (however not complete as my DC has thee IPs 10.0.0.101 &
10.0.1.101 and I am only getting the first one) but am not able to
connect...
The port to which the connection should be established is in fact open.
In the log below I replaced the Domains with the generic domain .
My workgroup is basically my domain without the tld, just to avoid
confusion.

net ads info -s /etc/samba/.conf -d 10 returned:
INFO: Current debug levels:
  all: 10
 [...]
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit
(16384)
INFO: Current debug levels:
  [...]
Processing section "[global]"
doing parameter workgroup = 
doing parameter realm = 
doing parameter netbios name = localhost
doing parameter server string = localhost
doing parameter pid directory = /usr/local/pf/var/run/
doing parameter lock directory = /var/cache/samba
doing parameter private dir = /var/cache/samba
doing parameter security = ADS
doing parameter winbind use default domain = no
doing parameter idmap uid = 600-2
WARNING: The "idmap uid" option is deprecated
doing parameter idmap gid = 600-2
WARNING: The "idmap gid" option is deprecated
doing parameter template shell = /bin/bash
doing parameter winbind expand groups = 10
doing parameter password server = *
doing parameter domain master = no
doing parameter local master = no
doing parameter preferred master = no
doing parameter inherit permissions = yes
doing parameter admin users = @\"domain admins"
doing parameter hide files =
/~*/Thumbs.db/desktop.ini/ntuser.ini/NTUSER.*/SMax.*/
doing parameter veto files = /lost+found/
doing parameter allow trusted domains = yes
doing parameter show add printer wizard = no
doing parameter disable spoolss = yes
doing parameter load printers = no
doing parameter printing = bsd
doing parameter printcap name = /dev/null
doing parameter usershare max shares = 0
doing parameter browseable = no
doing parameter guest ok = no
doing parameter machine password timeout = 0
doing parameter client ipc signing = auto
pm_process() returned Yes
lp_servicenumber: couldn't find homes
messaging_dgm_ref: messaging_dgm_init returned Erfolg
messaging_dgm_ref: unique = 16363321606826345832
Registering messaging pointer for type 2 - private_data=(nil)
Registering messaging pointer for type 9 - private_data=(nil)
Registered MSG_REQ_POOL_USAGE
Registering messaging pointer for type 11 - private_data=(nil)
Registering messaging pointer for type 12 - private_data=(nil)
Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
Registering messaging pointer for type 1 - private_data=(nil)
Registering messaging pointer for type 5 - private_data=(nil)
messaging_init: my id: 26541
lp_load_ex: refreshing parameters
Freeing parametrics:
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit
(16384)
INFO: Current debug levels:
  [...]
Processing section "[global]"
doing parameter workgroup = 
doing parameter realm = 
doing parameter netbios name = localhost
doing parameter server string = localhost
doing parameter pid directory = /usr/local/pf/var/run/
doing parameter lock directory = /var/cache/samba
doing parameter private dir = /var/cache/samba
doing parameter security = ADS
doing parameter winbind use default domain = no
doing parameter idmap uid = 600-2
WARNING: The "idmap uid" option is deprecated
doing parameter idmap gid = 600-2
WARNING: The "idmap gid" option is deprecated
doing parameter template shell = /bin/bash
doing parameter winbind expand groups = 10
doing parameter password server = *
doing parameter domain master = no
doing parameter local master = no
doing parameter preferred master = no
doing parameter inherit permissions = yes
doing parameter admin users = @\"domain admins"
doing parameter hide files =
/~*/Thumbs.db/desktop.ini/ntuser.ini/NTUSER.*/SMax.*/
doing parameter veto files = /lost+found/
doing parameter allow trusted domains = yes
doing parameter show add printer wizard = no

Re: [PacketFence-users] Failed to join domain

2020-01-25 Thread Christian Hillebrand via PacketFence-users
I just feel like an idiot now...
So apparently pf received the DMZ IP of my DC however a direct connection 
through ens224.100 failed. After turning the interface down (and therefore 
forcing the traffic through my pfSense) it worked... I just changed the order 
of the DNS entries and am now receiving the correct IP.
After manipulating my hosts file to get rid of another error, I joined the 
domain successful.
Thank you all for your help!
Regards
Christian

-Ursprüngliche Nachricht-
Von: Durand fabrice via PacketFence-users 
 
Gesendet: Samstag, 25. Januar 2020 14:34
An: packetfence-users@lists.sourceforge.net
Cc: Durand fabrice 
Betreff: Re: [PacketFence-users] Failed to join domain

Hi

It looks that samba try to connect to 10.0.0.101 (vlan 100).

 ads_try_connect: sending CLDAP request to 10.0.0.101 (realm:
)
 ads_cldap_netlogon: did not get a reply

Are you able to ping 10.0.0.101 ?

Also in your pfsense allow any/any from pf to 10.0.0.101.

Regards

Fabrice


Le 20-01-25 à 07 h 34, Christian Hillebrand via PacketFence-users a écrit :
> Hi,
> unfortunately I just found enough time to check your suggestions:
> I added a static route to direct traffic from 169.254.0.0/30 to my pf 
> machine (10.0.1.2).
> I tried to find my dc but with no luck.
> When enabling the debug mode I could see that I am getting the correct 
> DNS entries back (however not complete as my DC has thee IPs 
> 10.0.0.101 &
> 10.0.1.101 and I am only getting the first one) but am not able to 
> connect...
> The port to which the connection should be established is in fact open.
> In the log below I replaced the Domains with the generic domain .
> My workgroup is basically my domain without the tld, just to avoid 
> confusion.
>
> net ads info -s /etc/samba/.conf -d 10 returned:
>   INFO: Current debug levels:
> all: 10
>[...]
>   lp_load_ex: refreshing parameters
>   Initialising global parameters
>   rlimit_max: increasing rlimit_max (1024) to minimum Windows limit
> (16384)
>   INFO: Current debug levels:
> [...]
>   Processing section "[global]"
>   doing parameter workgroup = 
>   doing parameter realm = 
>   doing parameter netbios name = localhost
>   doing parameter server string = localhost
>   doing parameter pid directory = /usr/local/pf/var/run/
>   doing parameter lock directory = /var/cache/samba
>   doing parameter private dir = /var/cache/samba
>   doing parameter security = ADS
>   doing parameter winbind use default domain = no
>   doing parameter idmap uid = 600-2
>   WARNING: The "idmap uid" option is deprecated
>   doing parameter idmap gid = 600-2
>   WARNING: The "idmap gid" option is deprecated
>   doing parameter template shell = /bin/bash
>   doing parameter winbind expand groups = 10
>   doing parameter password server = *
>   doing parameter domain master = no
>   doing parameter local master = no
>   doing parameter preferred master = no
>   doing parameter inherit permissions = yes
>   doing parameter admin users = @\"domain admins"
>   doing parameter hide files =
> /~*/Thumbs.db/desktop.ini/ntuser.ini/NTUSER.*/SMax.*/
>   doing parameter veto files = /lost+found/
>   doing parameter allow trusted domains = yes
>   doing parameter show add printer wizard = no
>   doing parameter disable spoolss = yes
>   doing parameter load printers = no
>   doing parameter printing = bsd
>   doing parameter printcap name = /dev/null
>   doing parameter usershare max shares = 0
>   doing parameter browseable = no
>   doing parameter guest ok = no
>   doing parameter machine password timeout = 0
>   doing parameter client ipc signing = auto
>   pm_process() returned Yes
>   lp_servicenumber: couldn't find homes
>   messaging_dgm_ref: messaging_dgm_init returned Erfolg
>   messaging_dgm_ref: unique = 16363321606826345832
>   Registering messaging pointer for type 2 - private_data=(nil)
>   Registering messaging pointer for type 9 - private_data=(nil)
>   Registered MSG_REQ_POOL_USAGE
>   Registering messaging pointer for type 11 - private_data=(nil)
>   Registering messaging pointer for type 12 - private_data=(nil)
>   Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
>   Registering messaging pointer for type 1 - private_data=(nil)
>   Registering messaging pointer for type 5 - private_data=(nil)
>   messaging_init: my id: 26541
>   lp_load_ex: refreshing parameters
>   Freeing parametrics:
>   Initialising global parameters
>   rlimit_max: increasing rlimit_max (1024

[PacketFence-users] Packetfence rejects requests from pfSense openVPN

2020-03-18 Thread Christian Hillebrand via PacketFence-users
Hi,

At the moment I am testing the user authorization of requests coming from my
openVPN server which is part of my pfSense machine.

I added the pfSense machine as a "Generic" Switch and enabled CLI Access.

However when I am testing the access, I am rejected with the following log
output:

Mar 18 17:27:09 localhost packetfence_httpd.aaa: httpd.aaa(1667) INFO:
[mac:10:25:51:14:10:10] handling radius autz request: from switch_ip =>
(10.0.1.1), connection_type => CLI-Access,switch_mac => (00:1b:21:bc:e2:14),
mac => [10:25:51:14:10:10], port => 41010, username => ""
(pf::radius::authorize)
Mar 18 17:27:09 localhost packetfence_httpd.aaa: httpd.aaa(1667) WARN:
[mac:10:25:51:14:10:10] (10.0.1.1) Sending REJECT since switch is
unsupported (pf::radius::_switchUnsupportedReply)

Setup:

pfSense is configured to use packetfence as a radius authentication server. 

I configured packetfence to work as a radius server providing access to my
unifi based network. To achieve this I configured an AD as my authentication
source. In the authentication source I added three accept rules, each
handling users of one of my three "access groups".

However if it is possible I want to achieve, that only the users of the
first group are accepted when they request VPN access.

Each of the access groups is getting access to my (internal) network on a
different VLAN, which is assigned by packetfence via a role.

 

So I have two questions:

Is the setup which I described even possible?

Is pfSense not supported? Or did I mess up the config?

___
PacketFence-users mailing list
PacketFence-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/packetfence-users


Re: [PacketFence-users] Packetfence rejects requests from pfSense openVPN

2020-03-22 Thread Christian Hillebrand via PacketFence-users
Hi,

I just tested your recommendation, however I am still getting the same log 
entries prepended with the information, that the SNMP connection was 
unsuccessful. This should be no surprise as I did not configure any SNMP 
settings.

Regards

Christian

 

Von: Durand fabrice via PacketFence-users 
 
Gesendet: Donnerstag, 19. März 2020 01:34
An: packetfence-users@lists.sourceforge.net
Cc: Durand fabrice 
Betreff: Re: [PacketFence-users] Packetfence rejects requests from pfSense 
openVPN

 

Try with the Catalyst_2960 switch module instead of the generic one

Le 20-03-18 à 20 h 23, Zacharry Williams via PacketFence-users a écrit :

Not sure if it's supported as it's not in the device config guide. But that 
doesn't mean it's not possible. I think you'd have to make a different 
connection profile though.

On Wed, Mar 18, 2020, 11:39 AM Christian Hillebrand via PacketFence-users 
mailto:packetfence-users@lists.sourceforge.net> > wrote:

Hi,

At the moment I am testing the user authorization of requests coming from my 
openVPN server which is part of my pfSense machine.

I added the pfSense machine as a “Generic” Switch and enabled CLI Access.

However when I am testing the access, I am rejected with the following log 
output:

Mar 18 17:27:09 localhost packetfence_httpd.aaa: httpd.aaa(1667) INFO: 
[mac:10:25:51:14:10:10] handling radius autz request: from switch_ip => 
(10.0.1.1), connection_type => CLI-Access,switch_mac => (00:1b:21:bc:e2:14), 
mac => [10:25:51:14:10:10], port => 41010, username => "" 
(pf::radius::authorize)
Mar 18 17:27:09 localhost packetfence_httpd.aaa: httpd.aaa(1667) WARN: 
[mac:10:25:51:14:10:10] (10.0.1.1) Sending REJECT since switch is unsupported 
(pf::radius::_switchUnsupportedReply)

Setup:

pfSense is configured to use packetfence as a radius authentication server. 

I configured packetfence to work as a radius server providing access to my 
unifi based network. To achieve this I configured an AD as my authentication 
source. In the authentication source I added three accept rules, each handling 
users of one of my three “access groups”.

However if it is possible I want to achieve, that only the users of the first 
group are accepted when they request VPN access.

Each of the access groups is getting access to my (internal) network on a 
different VLAN, which is assigned by packetfence via a role.

 

So I have two questions:

Is the setup which I described even possible?

Is pfSense not supported? Or did I mess up the config?

___
PacketFence-users mailing list
PacketFence-users@lists.sourceforge.net 
<mailto:PacketFence-users@lists.sourceforge.net> 
https://lists.sourceforge.net/lists/listinfo/packetfence-users






___
PacketFence-users mailing list
PacketFence-users@lists.sourceforge.net 
<mailto:PacketFence-users@lists.sourceforge.net> 
https://lists.sourceforge.net/lists/listinfo/packetfence-users

___
PacketFence-users mailing list
PacketFence-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/packetfence-users