Wireless Access

 View Only
last person joined: yesterday 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Back to discussions
Expand all | Collapse all

RADIUS data

This thread has been viewed 25 times

  • 1.  RADIUS data

    MVP
    Posted Apr 06, 2021 07:23 PM
    We currently use FortiNAC as our RADIUS server and it works great in conjunction with Aruba OS. However, I'd like to start creating some more advanced role-based access polices based on the AP group, or AP name, that a client has just authenticated to. My question is, when a client authenticates, what data is sent back to the RADIUS server to utilize for role-based access? Right now, all I'm trying to do is get the AP group or AP name of the access point that the client is currently connected to.

    Thanks.

    ------------------------------
    Nathan Kuhl
    ------------------------------


  • 2.  RE: RADIUS data

    MVP EXPERT
    Posted Apr 07, 2021 03:47 AM
      |   view attached
    Hi Nathan,

    Below an example of an incoming radius-request from a Aruba controller. The information your looking for are the first four lines, also known as Aruba Vendor Specific Attributes (VSA). Because this are not standard IETF RADIUS attributes you have to find out how to use them.

    Not sure, but maybe you can find some usefull information in the xml file in the attachment.

    Radius:Aruba:Aruba-AP-Group	Zaltbommel-VC
Radius:Aruba:Aruba-Device-Type	iPhone
Radius:Aruba:Aruba-Essid-Name	HomeLAB-Corp
Radius:Aruba:Aruba-Location-Id	Zaltbommel-AP01
Radius:IETF:Called-Station-Id	f05c19xxxxxx
Radius:IETF:Calling-Station-Id	aad562xxxxx
Radius:IETF:Framed-MTU	1100
Radius:IETF:NAS-Identifier	test
Radius:IETF:NAS-IP-Address	172.16.200.240
Radius:IETF:NAS-Port	0
Radius:IETF:NAS-Port-Type	19
Radius:IETF:Service-Type	2
Radius:IETF:User-Name	marcelkoedijk​


    ------------------------------
    Marcel Koedijk | MVP Guru 2021 | ACMP | ACCP | ACDA | Ekahau ECSE | Not an HPE Employee | Opionions are my own
    ------------------------------

    Attachment(s)

    xml
    RadiusDictionary.xml   6 KB 1 version
    Original Message


  • 3.  RE: RADIUS data

    MVP
    Posted Apr 07, 2021 06:33 AM
    Thank you Marcel. Now the question is, how do I utilize the AP-group VSA within my RADIUS server. I'll have to talk to support on that one. FortiNAC uses FreeRADIUS so I'm sure there's an answer, although not obvious up front.

    -- 
    Nathan Kuhl
    Information Technology
    Wyoming Seminary
    570-270-2241
    *** Please report all problems to the help desk: https://helpdesk.wyomingseminary.org ***




    Original Message


  • 4.  RE: RADIUS data

    MVP EXPERT
    Posted Apr 07, 2021 08:53 AM
    Agree with Bruce, that the same xml file i attached before. You can find the radius ID numbers in it what you can uses to create your own VSA's.

    ------------------------------
    Marcel Koedijk | MVP Guru 2021 | ACMP | ACCP | ACDA | Ekahau ECSE | Not an HPE Employee | Opionions are my own
    ------------------------------

    Original Message


  • 5.  RE: RADIUS data

    MVP
    Posted Apr 07, 2021 08:58 AM
    You can use the VSAs already defined by Aruba, You cannot create your own. There may be a RADIUS dictionary you could import or define on your RADIUS server to make using the VSAs more user friendly.

    ------------------------------
    Bruce Osborne ACCP ACMP
    Liberty University

    The views expressed here are my personal views and not those of my employer
    ------------------------------

    Original Message


  • 6.  RE: RADIUS data

    MVP
    Posted Apr 08, 2021 09:49 AM
    FYI ClearPass is also FreeRADIUS based

    ------------------------------
    Bruce Osborne ACCP ACMP
    Liberty University

    The views expressed here are my personal views and not those of my employer
    ------------------------------

    Original Message


  • 7.  RE: RADIUS data

    MVP
    Posted Apr 07, 2021 08:47 AM
      |   view attached
    That is documented in the Aruba RADUIS VSA . There are 46 values currently defined according to ClearPass.
    I have attached an XML file describing the VSA.


    ------------------------------
    Bruce Osborne ACCP ACMP
    Liberty University

    The views expressed here are my personal views and not those of my employer
    ------------------------------

    Attachment(s)

    xml
    RadiusDictionary.xml   4 KB 1 version
    Original Message