Re: [PacketFence-users] 802.1x authentication

2024-06-19 Thread Zammit, Ludovic via PacketFence-users
Hello Hassan, SNMP-TRAPS = port security, don’t do that. The config that you showed does not do port-security but just radius. Your switch config is working, your issue is most likely that you need to Strip the default realm. Thanks, Ludovic Zammit Product Support Engineer Principal Lead Cel

[PacketFence-users] 802.1x authentication

2024-06-15 Thread Hassan Kouchtafi via PacketFence-users
Hassan Kouchtafi 10:28 PM (0 minutes ago) to Ludovic Thank you for the feedback, I have not been successfully able to set up 802.1x authentication with packet fence last time I tried it broke the server and I have to rebuild a new one. SNMP-TRAPS works perfectly. The part that didn't work for me

[PacketFence-users] 802.1X authentication via packetfence to AzureAD

2022-06-08 Thread Roger Maia via PacketFence-users
Hi packetfence-users We were wondering if you could assist us. We tried following the installation guide 11 times and are still not able to get this right. We have tried the following in the installation guide points 13.4 (SAML) and 13.7 (Azure AD). There seem to be some steps missing in the gui

Re: [PacketFence-users] 802.1x Authentication produces REST-API Timeout

2021-06-15 Thread Matthies, Heiko via PacketFence-users
.net Cc: Matthies, Heiko Betreff: RE: [PacketFence-users] 802.1x Authentication produces REST-API Timeout Hello, Issue is caused by: > Jun 14 15:40:07 packetfence packetfence_httpd.aaa: httpd.aaa(2311) ERROR: > [mac:f8:ca:b8:32:c7:fe] error creating SNMP v2c read connection to :

Re: [PacketFence-users] 802.1x Authentication produces REST-API Timeout

2021-06-14 Thread Quiniou-Briand, Nicolas via PacketFence-users
Hello, Issue is caused by: > Jun 14 15:40:07 packetfence packetfence_httpd.aaa: httpd.aaa(2311) ERROR: > [mac:f8:ca:b8:32:c7:fe] error creating SNMP v2c read connection to : > No response from remote host "" (pf::Switch::connectRead) SNMP needs to work between PacketFence clust

[PacketFence-users] 802.1x Authentication produces REST-API Timeout

2021-06-14 Thread Matthies, Heiko via PacketFence-users
Greetings, I’m currently integrating PacketFence into our company network. Last week I created a cluster consisting of 3 nodes (one node per Site). While my test device works at every switch I connect it to, every new device gets rejected with the following radius.log message: Jun 14 15:46

Re: [PacketFence-users] 802.1x authentication on Cisco WLC

2018-06-12 Thread Steve Pfister via PacketFence-users
Thank you for your response. I had thought the "Encryption-required" in the Radius response meant that encryption was required, but was not being negotiated. I guess this doesn't seem to be the case. The problem turned out to be in the VLAN I was trying to place the user in after authentication

Re: [PacketFence-users] 802.1x authentication on Cisco WLC

2018-06-11 Thread Durand fabrice via PacketFence-users
Hello Steve, run : raddebug -f /usr/local/pf/var/run/radiusd.sock -t 3000 reconnect and paste the debug. Regards Fabrice Le 2018-06-11 à 16:05, Steve Pfister via PacketFence-users a écrit : I am trying to get 802.1x authentication working on a Cisco WLC 5520. The client machines are all W

[PacketFence-users] 802.1x authentication on Cisco WLC

2018-06-11 Thread Steve Pfister via PacketFence-users
I am trying to get 802.1x authentication working on a Cisco WLC 5520. The client machines are all Windows 10. I have a registration and isolation vlan set up. The clients seem to get registered and authenticated OK, but never get a dhcp address and the radius reply says "Encryption-required". C

Re: [PacketFence-users] 802.1x authentication failed via windows AD

2016-09-28 Thread Sarayuth Sarayuth
Hi Fabrice, Now I got it. Many thanks for your best effort. The last one, I have a question about packetfence integrated with firewall(Fortinet) for SSL VPN authentication. Scenario: I would like to create 2 user groups. - Vendor group from packetfence local user source. - Employees group from win

Re: [PacketFence-users] 802.1x authentication

2015-06-10 Thread Sohaib Afourid
Thank yoy Louis again. I left my work place for now. I'll try all this first thing tomorrow. -- ___ PacketFence-users mailing list PacketFence-users@lists.sourceforge.net https://

Re: [PacketFence-users] 802.1x authentication

2015-06-10 Thread Louis Munro
Where to begin… On Jun 10, 2015, at 3:57 , Sohaib Afourid wrote: > Hello Louis, > As requested here are the config files and arp output. > > >>>arp -a from my centos PF server: > > root@centos ~]# arp -a > WIN-2008.packetfence.local (172.16.202.20) at 08:00:27:8d:10:10 [ether] on > eth0 > ? (

Re: [PacketFence-users] 802.1x authentication

2015-06-10 Thread Louis Munro
One thing at a time. Get the normal workflow to work before you try to get fancy. -- Louis Munro lmu...@inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org) On Jun 10, 2015, at 4:1

Re: [PacketFence-users] 802.1x authentication

2015-06-10 Thread Sohaib Afourid
I also i have a new issue, when i register a device manually, I plug my client out and in back again, i authenticate and get redirected to the Normal vlan, but when i apply a violation, i get redirected to the registration vlan and not the isolation one.

Re: [PacketFence-users] 802.1x authentication

2015-06-10 Thread Sohaib Afourid
Hello Louis, As requested here are the config files and arp output. >>>arp -a from my centos PF server: root@centos ~]# arp -a WIN-2008.packetfence.local (172.16.202.20) at 08:00:27:8d:10:10 [ether] on eth0 ? (172.16.202.10) at c8:9c:1d:f4:82:c1 [ether] on eth0 >>>arp -a from my Windows 7 host:

Re: [PacketFence-users] 802.1x authentication

2015-06-10 Thread Sohaib Afourid
I guess it depends on the type of the violation, because when I applied a bandwidth violation it got redirected to the registration vlan, but when i applied a Rogue DHCP violation it got redirected to the isolation vlan. is it possible to change that ? I mean which vlan should the client be redirec

Re: [PacketFence-users] 802.1x authentication

2015-06-08 Thread Louis Munro
Why dont you post a copy of your pf.conf, network.conf and switches.conf. That would help a lot. Regards, -- Louis Munro lmu...@inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

Re: [PacketFence-users] 802.1x authentication

2015-06-08 Thread Louis Munro
On Jun 8, 2015, at 11:55 , Sohaib Afourid wrote: > Hello again, > I installed wireshark on my centos virtualbox and this is what i got. > It got a "DHCP Inform" from 172.16.202.2 which is my windows 7 host ip > address but then it stays at "DHCP Discover" on both sides, centos > (Packetfence

Re: [PacketFence-users] 802.1x authentication

2015-06-08 Thread Sohaib Afourid
Hello again, I installed wireshark on my centos virtualbox and this is what i got. It got a "DHCP Inform" from 172.16.202.2 which is my windows 7 host ip address but then it stays at "DHCP Discover" on both sides, centos (Packetfence server) and my client laptop (unregistred device on Registration

Re: [PacketFence-users] 802.1x authentication

2015-06-08 Thread Sohaib Afourid
Hello again, About the DHCP issue, I only installed wireshark on the client side, I'm going to install it now on my server side, (but should i use wireshark or just tcpdump ?) I'll install it now and let you know the results. -

Re: [PacketFence-users] 802.1x authentication

2015-06-08 Thread Louis Munro
On Jun 8, 2015, at 9:40 , Sohaib Afourid wrote: > Here is it. > Should "MS-CHAP-Use-NTLM-Auth" be Yes or No (in both sections) ? > > You have it correct. Don’t mess with it now and fix your DHCP problem. -- Louis Munro lmu...@inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866)

Re: [PacketFence-users] 802.1x authentication

2015-06-08 Thread Sohaib Afourid
Here is it. Should "MS-CHAP-Use-NTLM-Auth" be Yes or No (in both sections) ? server packetfence-tunnel { authorize { suffix ntdomain eap { ok = return } files sql update control { MS-CHAP-Use-NTLM-Auth := No

Re: [PacketFence-users] 802.1x authentication

2015-06-08 Thread Louis Munro
On Jun 8, 2015, at 9:16 , Louis Munro wrote: > > Why would you want that? > > Anyway, suit yourself. > The option is in the GUI, under Configuration > Advanced. Ahh. Sorry, not enough coffee in the bloodstream yet. Yes bcrypt hashed passwords and ntlm_auth don’t play well together. Disable

Re: [PacketFence-users] 802.1x authentication

2015-06-08 Thread Louis Munro
On Jun 8, 2015, at 6:17 , Sohaib Afourid wrote: > Hello Louis, > As I mentioned earlier, i'm still failing to authenticate via MySQL, and also > as we were discussing the other day, you recommened that I use Wireshark to > monitor the DHCP request, well I did, and when i plug my laptop into t

Re: [PacketFence-users] 802.1x authentication

2015-06-08 Thread Louis Munro
On Jun 8, 2015, at 3:25 , Sohaib Afourid wrote: > Hello Louis, IT'S ME AGAIN !! > > this is my packetfence-tunnel file and i checked my pf.conf file, i have no > password encryption set, but when i checked the password table at mysql > database all the passwords were encrypted, Because tha

Re: [PacketFence-users] 802.1x authentication

2015-06-08 Thread Sohaib Afourid
Hello Louis, As I mentioned earlier, i'm still failing to authenticate via MySQL, and also as we were discussing the other day, you recommened that I use Wireshark to monitor the DHCP request, well I did, and when i plug my laptop into the switch and successfuly authenticate, on Wireshark, my lapto

Re: [PacketFence-users] 802.1x authentication

2015-06-08 Thread Sohaib Afourid
Hello Louis, IT'S ME AGAIN !! this is my packetfence-tunnel file and i checked my pf.conf file, i have no password encryption set, but when i checked the password table at mysql database all the passwords were encrypted, how can i disable that ? server packetfence-tunnel { authorize { su

Re: [PacketFence-users] 802.1x authentication

2015-06-04 Thread Sohaib Afourid
Okay Louis, I left my work place for now. I'll check this first thing tomorrow and let you know. Thank you. -- ___ PacketFence-users mailing list PacketFence-users@lists.sourcefor

Re: [PacketFence-users] 802.1x authentication

2015-06-04 Thread Louis Munro
On Jun 4, 2015, at 11:01 , Sohaib Afourid wrote: > i should only uncomment the line pflocal right ? No. The whole block of unlang. > There is also another issue with my host, it runs so slow right now, like > when i start the virtual host it takes almost 7 min to get to the centos user > au

Re: [PacketFence-users] 802.1x authentication

2015-06-04 Thread Sohaib Afourid
Hello again Louis; This is what i got from radius log. Thu Jun 4 16:14:12 2015 : Error: rlm_sql_mysql: Mysql error 'Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2)' Thu Jun 4 16:14:12 2015 : Error: rlm_sql (sql): Failed to connect DB handle #0 Thu Jun 4 16:14

Re: [PacketFence-users] 802.1x authentication

2015-06-04 Thread Sohaib Afourid
i should only uncomment the line pflocal right ? There is also another issue with my host, it runs so slow right now, like when i start the virtual host it takes almost 7 min to get to the centos user authentication page and everything runs slow,like right now i tried restarting the radiusd service

Re: [PacketFence-users] 802.1x authentication

2015-06-04 Thread Louis Munro
On Jun 4, 2015, at 10:24 , Sohaib Afourid wrote: > Hello Louis, i'm working on Wireshark right now, > I have a question. How can use internal mysql database to do radius > authentication ? which table from the pf database should i populate ? radacct > ? No. Use the GUI for that. The “users”

Re: [PacketFence-users] 802.1x authentication

2015-06-04 Thread Sohaib Afourid
Hello Louis, i'm working on Wireshark right now, I have a question. How can use internal mysql database to do radius authentication ? which table from the pf database should i populate ? radacct ? 2015-06-03 17:06 GMT+01:00 Sohaib Afourid : > Hello James, > I checked the httpd.aaa.error file and

Re: [PacketFence-users] 802.1x authentication

2015-06-03 Thread Louis Munro
First make sure that the dhcp service is running. Then, before changing anything, make sure the VLAN is trunked properly. Do not try to guess, or rely on the configuration. Be skeptical and run tcpdump on both endpoints. Well, actually you probably only need to use wireshark from the laptop side

Re: [PacketFence-users] 802.1x authentication

2015-06-03 Thread Sohaib Afourid
Silly as it may sound, even I havent seen much of the Atlas mountains really, I live in the north and i didn't get much travel. So maybe if you come we can take a hike together :D. -- ___

Re: [PacketFence-users] 802.1x authentication

2015-06-03 Thread Sohaib Afourid
Hello James, I checked the httpd.aaa.error file and all i have there is a warn saying: RSA server certificate CommonName (CN) '127.0.0.1' does NOT match server name !? i've been having this since forever. Is it what causing the problem ? 2015-06-03 18:03 GMT+02:00 Sohaib Afourid : > Well, It's d

Re: [PacketFence-users] 802.1x authentication

2015-06-03 Thread Sohaib Afourid
Well, It's doesnt seem like you guy will get rid of me any time sooner. So my laptop now is in the registration vlan, i have dhcp enabled in the networks.conf file but it doesnt get an ip address. I have the management and normal vlan configured in my switch. should i change or add something in dhc

Re: [PacketFence-users] 802.1x authentication

2015-06-03 Thread James Rouzier
Hello Sohaib, I suspect there is a problem with httpd.aaa service which is required for packetfence radius interaction. You can check the following log /usr/local/pf/logs/httpd.aaa.error To Check to see if httpd.aaa is running /usr/local/pf/bin/pfcmd service httpd.aaa status To restart the

Re: [PacketFence-users] 802.1x authentication

2015-06-03 Thread Louis Munro
On Jun 3, 2015, at 11:29 , Sohaib Afourid wrote: > The second to last message i sent you, it's the result when i ran radius in > debug mode. i got this error: > "rlm_perl: An error occurred while processing the authorize RPC request: An > error occured while sending a MessagePack request: 7 Co

Re: [PacketFence-users] 802.1x authentication

2015-06-03 Thread Sohaib Afourid
The second to last message i sent you, it's the result when i ran radius in debug mode. i got this error: "rlm_perl: An error occurred while processing the authorize RPC request: An error occured while sending a MessagePack request: 7 Couldn't connect to server couldn't connect to host at /usr/loc

Re: [PacketFence-users] 802.1x authentication

2015-06-03 Thread Louis Munro
On Jun 3, 2015, at 10:12 , Sohaib Afourid wrote: > Hello Louis, > It seems like there is an issue with running radiusd in debug mode (as i read > in the mailing list), so i tried normal radius and it worked :D Not sure what you are talking about. Debug mode works just fine when used correctly

Re: [PacketFence-users] 802.1x authentication

2015-06-03 Thread Sohaib Afourid
Hello Louis. take a look at this, i still can't authenticate successfuly [root@centos ~]# ntlm_auth --username nissan password: NT_STATUS_OK: Success (0x0) [root@centos ~]# And here is the outcome of radiusd -X -d /usr/local/pf/raddb Waking up in 4.9 seconds. rad_recv: Access-Request packet fro

Re: [PacketFence-users] 802.1x authentication

2015-06-03 Thread Sohaib Afourid
Hello Louis, It seems like there is an issue with running radiusd in debug mode (as i read in the mailing list), so i tried normal radius and it worked :D Thank you very much. So now when i plugg my laptop in the switch, i use the credentials stored in AD and i get redirected to the registration vl

Re: [PacketFence-users] 802.1x authentication

2015-06-03 Thread Sohaib Afourid
Hello Louis. I got it, thank you. now i'm gonna test with packetfence and let you know the results. Is my switch configuration right ? # ntlm_auth --username nissan password: NT_STATUS_OK: Success (0x0) --

Re: [PacketFence-users] 802.1x authentication

2015-06-02 Thread Sohaib Afourid
Oh dear lord... -- ___ PacketFence-users mailing list PacketFence-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/packetfence-users

Re: [PacketFence-users] 802.1x authentication

2015-06-02 Thread Sohaib Afourid
Also, would you please take a look at my switch configuration, i'm using a Cisco Catalyst 3560 (should i change SNMP to v3 ?) Building configuration... Current configuration : 6860 bytes ! ! Last configuration change at 00:46:26 UTC Sat Apr 2 2011 by admin ! NVRAM config last updated at 08:32:10

Re: [PacketFence-users] 802.1x authentication

2015-06-02 Thread Louis Munro
On Jun 2, 2015, at 12:04 , Sohaib Afourid wrote: > I really can't see what's wrong with that line, How many dots should there be in an IPv4 address? Unless you pasted it incorrectly... Regards, -- Louis Munro lmu...@inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x

Re: [PacketFence-users] 802.1x authentication

2015-06-02 Thread Sohaib Afourid
Okay thank you. I really can't see what's wrong with that line, i'll remove samba4 and install samba3 and let you know the outcome. -- ___ PacketFence-users mailing list PacketFen

Re: [PacketFence-users] 802.1x authentication

2015-06-02 Thread Louis Munro
On Jun 2, 2015, at 11:44 , Sohaib Afourid wrote: > Here is the outcome: > > [root@centos ~]# rpm -qf /usr/bin/ntlm_auth > samba4-winbind-clients-4.0.0-66.el6_6.rc4.x86_64 > Erase that package and install samba 3. The ntlm_auth in samba4 does not include the —request-nt-key option. > As fo

Re: [PacketFence-users] 802.1x authentication

2015-06-02 Thread Sohaib Afourid
Here is the outcome: [root@centos ~]# rpm -qf /usr/bin/ntlm_auth samba4-winbind-clients-4.0.0-66.el6_6.rc4.x86_64 As for the hosts file, that's the ip adress of my windows server and the hostname, i followed some tutorials and it said it is supposed to be there. is it written wrong or not suppose

Re: [PacketFence-users] 802.1x authentication

2015-06-02 Thread Louis Munro
On Jun 2, 2015, at 11:14 , Sohaib Afourid wrote: > Okay. > Here you go. Sorry, I meant this command: # rpm -qf /usr/bin/ntlm_auth -- Louis Munro lmu...@inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and Pac

Re: [PacketFence-users] 802.1x authentication

2015-06-02 Thread Louis Munro
On Jun 2, 2015, at 11:16 , Sohaib Afourid wrote: > How is the third entry in my hosts file supposed to be ? > -- This is what you sent: /etc/hosts 127.0.0.1 centos.packetfence.local localhost centos 172.16.20

Re: [PacketFence-users] 802.1x authentication

2015-06-02 Thread Sohaib Afourid
How is the third entry in my hosts file supposed to be ? -- ___ PacketFence-users mailing list PacketFence-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo

Re: [PacketFence-users] 802.1x authentication

2015-06-02 Thread Sohaib Afourid
Okay. Here you go. samba-winbind-clients-3.6.23-12.el6.x86_64 : Samba winbind clients Repo: base Matched from: Filename: /usr/bin/ntlm_auth samba-winbind-clients-3.6.23-12.el6.i686 : Samba winbind clients Repo: base Matched from: Filename: /usr/bin/ntlm_auth samba4-win

Re: [PacketFence-users] 802.1x authentication

2015-06-02 Thread Louis Munro
On Jun 2, 2015, at 10:21 , Sohaib Afourid wrote: > [root@centos ~]# /usr/bin/ntlm_auth > Usage: ntlm_auth [OPTION...] > --helper-protocol=helper protocol to use operate as a stdio-based helper > --domain=STRING domain name > --workstation=STRING

Re: [PacketFence-users] 802.1x authentication

2015-06-02 Thread Louis Munro
On Jun 2, 2015, at 9:03 , Sohaib Afourid wrote: > [eap] EAP/mschapv2 > [eap] processing type mschapv2 > [mschapv2] # Executing group from file > /usr/local/pf/raddb/sites-enabled/packetfence-tunnel > [mschapv2] +group MS-CHAP { > [mschap] Creating challenge hash with username: nissan > [mschap

Re: [PacketFence-users] 802.1x authentication

2015-05-28 Thread Louis Munro
On May 28, 2015, at 7:50 , Sohaib Afourid wrote: > Hello. > Right now i'm configuring a domain and DNS server on Windows Server just for > a test. > But i'm still having a hard time understanding the 802.1x authentication with > packetfence. i've been asking since yesterday for a explanatory sc

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Boris Epstein
> > > Yes, but in his case all it means is that MAB succeeded. > His switch seems to try 802.1x first and then switch to MAB if > authentication fails. > > When using MAB, PacketFence will always authenticate successfully at the > RADIUS level. > It’s only later when sent to the captive portal that

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Louis Munro
On May 27, 2015, at 13:33 , Boris Epstein wrote: > Louis, > > Correct me if I am wrong but doesn't the fact that you have been allowed to > join a VLAN signify that you have passed the port-level security > authentication? Yes, but in his case all it means is that MAB succeeded. His switch

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Boris Epstein
Louis, Correct me if I am wrong but doesn't the fact that you have been allowed to join a VLAN signify that you have passed the port-level security authentication? Boris. On Wed, May 27, 2015 at 10:56 AM, Louis Munro wrote: > On May 27, 2015, at 10:40 , Sohaib Afourid > wrote: > > I know, and

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Louis Munro
On May 27, 2015, at 12:08 , Sohaib Afourid wrote: > but right now I can't even get/ don't clearly understand how packetfence > works with 802.1x and a captive portal, i've been asking for an explanation > scenario but no one has provided it yet. > thank you. To be honest, a captive portal i

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Louis Munro
On May 27, 2015, at 11:58 , Jason 'XenoPhage' Frisvold wrote: > Where are you going to store user credentials? If you're not using > AD, are you going to use LDAP? Or are you planning on using all local > accounts via packetfence? (I *think* it supports that, but isn't > something I ever us

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Jason 'XenoPhage' Frisvold
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 5/27/15 11:49, Sohaib Afourid wrote: > And i'm not using Active Directory or Windows Server. Where are you going to store user credentials? If you're not using AD, are you going to use LDAP? Or are you planning on using all local accounts via pac

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Louis Munro
On May 27, 2015, at 11:33 , Sohaib Afourid wrote: > Found Auth-Type = EAP > # Executing group from file > /usr/local/pf/raddb/sites-enabled/packetfence-tunnel > +group authenticate { > [eap] Request found, released from the list > [eap] EAP/mschapv2 > [eap] processing type mschapv2 > [mschapv2

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Sohaib Afourid
I meant switch config, i'm using a cisco catalyst 3560. 2015-05-27 17:18 GMT+02:00 Sohaib Afourid : > Again, thank you very much for your time and patience. > In my router configuration i followed the device guide provided by > packetfence. > Once i plug my laptop in the specified port, the authe

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Louis Munro
There is not authentication attempt in the output that you sent. We can’t help you if there is no error. Make sure to send at least one authentication to Radius so there is something to debug. -- Louis Munro lmu...@inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Sohaib Afourid
Again, thank you very much for your time and patience. In my router configuration i followed the device guide provided by packetfence. Once i plug my laptop in the specified port, the authentcation cloud pops up (since i configured my Windows 7 client for peap authentication, i also added the CA ce

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Louis Munro
On May 27, 2015, at 10:40 , Sohaib Afourid wrote: > I know, and I'm gratefull for that, but still, nobody has answered my > question, and my case is not explained in the documentation. the only think i > changed in etc/raddb is the eap type, i set it to PEAP because i don't want > to use a cli

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Sohaib Afourid
I know, and I'm gratefull for that, but still, nobody has answered my question, and my case is not explained in the documentation. the only think i changed in etc/raddb is the eap type, i set it to PEAP because i don't want to use a client certificate. What i need right now is for someone to explai

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Louis Munro
Let me save you some time. 1. Don’t use virtualbox. It has issues with VLANs. If you must use virtualization then use VMWare. 2. Don’t mess with the /etc/raddb 3. Wipe out what you have done and reinstall. 4. Follow the documentation. Step by step. Then, if it still does not work, come back and

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Sohaib Afourid
Can you at least explain to me a scenario for packetfence with 802.1x authentication with mysql. 2015-05-27 16:23 GMT+02:00 Sohaib Afourid : > well there are two radius instances, the one in /etc/raddb and the one in > /usr/local/pf > i changed the ports for the first one 1645 for auth and 1646 f

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Sohaib Afourid
well there are two radius instances, the one in /etc/raddb and the one in /usr/local/pf i changed the ports for the first one 1645 for auth and 1646 for acct and 1812/1813 for the pf radius. the first instance is stopped while the pf radiusd is launched. 2015-05-27 15:28 GMT+02:00 Sohaib Afourid :

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Boris Epstein
Hello there, Are you still running freeradius? If so, what is your plan for interfacing between freeradius and PF? Boris. On Wed, May 27, 2015 at 9:28 AM, Sohaib Afourid wrote: > Hello, i've been trying to set up Packetfence as part of a three month > internship. i'm using a Cisco Catalyst 356

Re: [PacketFence-users] 802.1x authentication

2015-05-27 Thread Fabrice DURAND
First you have to run radius in debug mode to see why it failed. radiusd -d /usr/local/pf/raddb -X Le 2015-05-27 09:28, Sohaib Afourid a écrit : > Hello, i've been trying to set up Packetfence as part of a three month > internship. i'm using a Cisco Catalyst 3560 switch and Centos 6.6 on a > virt

[PacketFence-users] 802.1x authentication

2015-05-27 Thread Sohaib Afourid
Hello, i've been trying to set up Packetfence as part of a three month internship. i'm using a Cisco Catalyst 3560 switch and Centos 6.6 on a virtualbox as a host for Packetfence, and my own personal laptop as a client. at first I set up freeradius (independently) succefully using PEAP. It worked p

Re: [PacketFence-users] 802.1x authentication does not use internal sources

2015-04-07 Thread Sergio Martinez Tagliafico
HI Fabrice, Like you said, the authentication fails with "\\" but work with "" (see the test below). Adding the Realm the authentication works correctly. Thaks for your help. # ./pftest authentication \\ ad-banco Testing authentication for "\" Authenticating a

Re: [PacketFence-users] 802.1x authentication does not use internal sources

2015-04-03 Thread Durand fabrice
Ok so based on the log, Autoreg has been enabled but the username doen't match, i think that it try to match with samaccountname=\\ and not samaccountname= So can you try to add as realm in packetfence (Configuration -> Realm) and in the ad.domain.com select use stripped usernam

Re: [PacketFence-users] 802.1x authentication does not use internal sources

2015-04-03 Thread Sergio Martinez Tagliafico
No problem, Now the log shows Apr 03 12:04:05 httpd.aaa(11755) INFO: [44:37:e6:e3:86:1f] handling radius autz request: from switch_ip => (x.x.x.x), connection_type => Ethernet-EAP,switch_mac => (Unknown), mac => [44:37:e6:e3:86:1f], port => 10001, username => "\\" (pf::radius::authorize)

Re: [PacketFence-users] 802.1x authentication does not use internal sources

2015-04-03 Thread Durand fabrice
Hello Sergio, sorry for the delay. So based on your config, you must define an access duration: [ad.domain.com rule Usuarios] description= Users match=all action0=set_role=Usuario action1=set_access_duration=1D Retry and let me know. Regards Fabrice Le 2015-04-02 18:41, Sergio Martinez Tagl

Re: [PacketFence-users] 802.1x authentication does not use internal sources

2015-04-03 Thread Sergio Martinez Tagliafico
One more detail, I have moved the ldap source (in the web admin interface) at the top position, but the ldap still unused. El abr 2, 2015 6:15 PM, "Sergio Martinez Tagliafico" escribió: > > Sorry about the nameS of roles and domain used, I did not changed all of them. > > thanks. > > 2015-04-02 1

Re: [PacketFence-users] 802.1x authentication does not use internal sources

2015-04-02 Thread Sergio Martinez Tagliafico
Here you are, Initialy vlan_filters.conf was empty and the authorization request still does not use ldap source (the log is attached) Thaks vlan_filters.conf: [EthernetEAP] filter = connection_type operator = match value = Et

Re: [PacketFence-users] 802.1x authentication does not use internal sources

2015-04-02 Thread Sergio Martinez Tagliafico
Sorry about the nameS of roles and domain used, I did not changed all of them. thanks. 2015-04-02 18:07 GMT-03:00 Sergio Martinez Tagliafico : > Here you are, > > Initialy vlan_filters.conf was empty and the authorization request still > does not use ldap source (the log is attached) > > Thaks >

Re: [PacketFence-users] 802.1x authentication does not use internal sources

2015-04-02 Thread Durand fabrice
Ok so you use vlan_filter too, so i need more details. Can you provide these files: vlan_filters.conf profile.conf authentication.conf Regards Fabrice Le 2015-04-02 16:07, Sergio Martinez Tagliafico a écrit : I have defined the filter with a ldap source (from the portal profile preview the aut

Re: [PacketFence-users] 802.1x authentication does not use internal sources

2015-04-02 Thread Sergio Martinez Tagliafico
I have defined the filter with a ldap source (from the portal profile preview the authz run fine) but the internal source is not used. [default] description=Default Profile logo=/common/packetfence-cp.png billing_engine=disabled redirecturl=http://www.packetfence.org/ always_use_redirecturl=disabl

Re: [PacketFence-users] 802.1x authentication does not use internal sources

2015-04-02 Thread Durand fabrice
Hello Sergio, let's configure a portal profile with filter switch : x.x.x.x and add the ldap source on it and retry. Regards Fabrice Le 2015-04-02 15:07, Sergio Martinez Tagliafico a écrit : Hi friends, I am in my first experience with packetfence and i am getting some issues. One of thos

[PacketFence-users] 802.1x authentication does not use internal sources

2015-04-02 Thread Sergio Martinez Tagliafico
Hi friends, I am in my first experience with packetfence and i am getting some issues. One of those is that I do not undertand why with 802.1x dos not use internal sources. Below is the log when radius handle an authz request: Apr 02 15:29:21 httpd.aaa(3355) INFO: [44:37:e6:x:x:x] handling radiu

Re: [PacketFence-users] 802.1x Authentication and Roles

2014-04-11 Thread Fabrice DURAND
Hello Lupe, you are true, i have to check in the custom.pm, just uncomment shouldAutoRegister like that: sub shouldAutoRegister { #$mac is MAC address #$switch_in_autoreg_mode is set to 1 if switch is in registration mode #$violation_autoreg is set to 1 if called from a violation w

[PacketFence-users] 802.1x Authentication and Roles

2014-04-11 Thread Lupe Silva
I am in the process of testing PF. I am able to utilize port security on the switches getting the portal page to log in and get to the appropriate vlan. I am using AD and assigning roles and vlan's based upon their OU. When I utilize 802.1x I am to get the workstation to authenticate via 8021.x b