On Thu, 7 Jul 2011, John Kaftan wrote: > I have fantasized about doing this but have feared the VLAN change would > not prompt the clients to ask for a new IP. Looks like you have a > different issue but do you know, if you get the VLAN switching working, > how the clients will realize they need to ask for another IP?
Nah, that's fine; the EAP/802.1X authentication stuff happens at layer 2 with the access point (which relays to radius); the client doesn't DHCP for an IP address until the supplicant has successfully authenticated (and hence the client been switched into the appropriate VLAN), so it's all fine in principle, and sometimes even in practice! Other people do the same thing with other equipment. (If you are particularly interested in this "single SSID" idea for both visitors/local users, there are at least a couple of papers at: http://www.ja.net/services/authentication-and-authorisation/janet-roaming/documentation.html ). > As for troubleshooting have you captured any packets between the > controller and your LAN infrastructure to see if your wireless is > tagging the packets? Do you have reporting at the controller that can > tell you if it is receiving the attribute correctly? You could capture > the RADIUS packet at it leaves the server to see if the attribute is > being passed to your controller as you believe it is. Yes, at the Radius server I can snoop the transaction between it and the access point, and I can see the attributes being returned to the AP. As I say, it sometimes does work, but mostly doesn't, and as far as I can reasonably tell the Proxim AP is the weak point. I can't get anything useful out of the AP at a low-level to see if it acknowledged/acted upon these attributes though. Jethro. > > John > > > > On 7/7/2011 11:47 AM, Jethro R Binks wrote: > > Hello all, > > > > I've been having problems using 802.1X authentication, or more > > specifically, assignment of VLANs based on the RADIUS attributes. > > > > Goal is to have one SSID, "eduroam", to which both visitors and local > > users authenticate when using the wireless service. Visitors remain in > > the VLAN to which the SSID is associated, and local users onsite are > > switched into a different VLAN based on attributes from the Radius server > > backend. > > > > In brief: > > > > I am running the latest v4.0.12 code (but had problems with previous > > versions too). > > > > I believe I have followed to the letter the Proxim knowledgebase article > > (which was updated a while ago ("VLAN Assignment by RADIUS"). > > > > I have tested with a variety of clients (Windows laptop, Windows mobile, > > Apple i-things). > > > > With no VLAN assignment (i.e., none of the Tunnel- attributes being sent > > by RADIUS), it usually works OK (sometimes with a couple of retries); but > > the local user remains in the "visitor" VLAN as expected. > > > > With the VLAN assignment enabled, it will usually NOT work. Once in a > > while you might get lucky and get connected to the right VLAN and get an > > address from DHCP, but it is very inconsistent and unreliable. As far as > > I can surmise, the problem is likeliest to lie with the AP. > > > > Since it does occasionally work, the basic infrastructure appears to be > > sound. > > > > So, I'm reaching out there to find if there are any other people doing > > something this with Proxim APs (AP4000 in particular), to see if you have > > seen these problems with other vendor or found a fix. Or, alternatively, > > maybe it isn't the AP, but something else you can suggest that might cause > > this inconsistent behaviour. > > > > Thanks for any thoughts, > > > > Jethro. > > > > . . . . . . . . . . . . . . . . . . . . . . . . . > > Jethro R Binks, Network Manager, > > Information Services Directorate, University Of Strathclyde, Glasgow, UK > > > > The University of Strathclyde is a charitable body, registered in > > Scotland, number SC015263. > > > > ********** > > Participation and subscription information for this EDUCAUSE Constituent > > Group discussion list can be found at http://www.educause.edu/groups/. > . . . . . . . . . . . . . . . . . . . . . . . . . Jethro R Binks, Network Manager, Information Services Directorate, University Of Strathclyde, Glasgow, UK The University of Strathclyde is a charitable body, registered in Scotland, number SC015263. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/.
