Wireless Access

last person joined: 2 minutes ago 

Access network design for branch, remote, outdoor and campus locations with Aruba access points, and mobility controllers.
Expand all | Collapse all

RADIUS data

This thread has been viewed 15 times
  • 1.  RADIUS data

    Posted 14 days ago
    We currently use FortiNAC as our RADIUS server and it works great in conjunction with Aruba OS. However, I'd like to start creating some more advanced role-based access polices based on the AP group, or AP name, that a client has just authenticated to. My question is, when a client authenticates, what data is sent back to the RADIUS server to utilize for role-based access? Right now, all I'm trying to do is get the AP group or AP name of the access point that the client is currently connected to.

    Thanks.

    ------------------------------
    Nathan Kuhl
    ------------------------------


  • 2.  RE: RADIUS data

    Posted 14 days ago
      |   view attached
    Hi Nathan,

    Below an example of an incoming radius-request from a Aruba controller. The information your looking for are the first four lines, also known as Aruba Vendor Specific Attributes (VSA). Because this are not standard IETF RADIUS attributes you have to find out how to use them.

    Not sure, but maybe you can find some usefull information in the xml file in the attachment.

    Radius:Aruba:Aruba-AP-Group	Zaltbommel-VC
    Radius:Aruba:Aruba-Device-Type	iPhone
    Radius:Aruba:Aruba-Essid-Name	HomeLAB-Corp
    Radius:Aruba:Aruba-Location-Id	Zaltbommel-AP01
    Radius:IETF:Called-Station-Id	f05c19xxxxxx
    Radius:IETF:Calling-Station-Id	aad562xxxxx
    Radius:IETF:Framed-MTU	1100
    Radius:IETF:NAS-Identifier	test
    Radius:IETF:NAS-IP-Address	172.16.200.240
    Radius:IETF:NAS-Port	0
    Radius:IETF:NAS-Port-Type	19
    Radius:IETF:Service-Type	2
    Radius:IETF:User-Name	marcelkoedijk​


    ------------------------------
    Marcel Koedijk | MVP Guru 2021 | ACMP | ACCP | ACDA | Ekahau ECSE | Not an HPE Employee | Opionions are my own
    ------------------------------

    Attachment(s)

    xml
    RadiusDictionary.xml   6 KB 1 version


  • 3.  RE: RADIUS data

    Posted 14 days ago
    Thank you Marcel. Now the question is, how do I utilize the AP-group VSA within my RADIUS server. I'll have to talk to support on that one. FortiNAC uses FreeRADIUS so I'm sure there's an answer, although not obvious up front.

    -- 
    Nathan Kuhl
    Information Technology
    Wyoming Seminary
    570-270-2241

    *** Please report all problems to the help desk: https://helpdesk.wyomingseminary.org ***






  • 4.  RE: RADIUS data

    Posted 14 days ago
    Agree with Bruce, that the same xml file i attached before. You can find the radius ID numbers in it what you can uses to create your own VSA's.

    ------------------------------
    Marcel Koedijk | MVP Guru 2021 | ACMP | ACCP | ACDA | Ekahau ECSE | Not an HPE Employee | Opionions are my own
    ------------------------------



  • 5.  RE: RADIUS data

    Posted 14 days ago
    You can use the VSAs already defined by Aruba, You cannot create your own. There may be a RADIUS dictionary you could import or define on your RADIUS server to make using the VSAs more user friendly.

    ------------------------------
    Bruce Osborne ACCP ACMP
    Liberty University

    The views expressed here are my personal views and not those of my employer
    ------------------------------



  • 6.  RE: RADIUS data

    Posted 13 days ago
    FYI ClearPass is also FreeRADIUS based

    ------------------------------
    Bruce Osborne ACCP ACMP
    Liberty University

    The views expressed here are my personal views and not those of my employer
    ------------------------------



  • 7.  RE: RADIUS data

    Posted 14 days ago
      |   view attached
    That is documented in the Aruba RADUIS VSA . There are 46 values currently defined according to ClearPass.
    I have attached an XML file describing the VSA.


    ------------------------------
    Bruce Osborne ACCP ACMP
    Liberty University

    The views expressed here are my personal views and not those of my employer
    ------------------------------

    Attachment(s)

    xml
    RadiusDictionary.xml   4 KB 1 version