9

I would like to use my RADIUS server to restrict access to configured SSID on a per user basis.

According to the documentation linked above i add the following attribute to a test user:

ospite-5vh Cisco-AVPair += "ssid=Interactive_Ospiti"

So, enabling debug radius authentication, i see:

Jun 12 08:30:08.266: RADIUS(00001A96): Send Access-Request to 212.183.164.38:1812 id 1645/128, len 177
Jun 12 08:30:08.266: RADIUS:  authenticator CC C9 63 16 B0 62 74 52 - A7 95 DF 1D 93 F3 08 37
Jun 12 08:30:08.267: RADIUS:  User-Name           [1]   12  "ospite-5vh"
Jun 12 08:30:08.267: RADIUS:  Framed-MTU          [12]  6   1400                      
Jun 12 08:30:08.267: RADIUS:  Called-Station-Id   [30]  16  "8478.acf0.9002"
Jun 12 08:30:08.267: RADIUS:  Calling-Station-Id  [31]  16  "2064.3267.44ca"
Jun 12 08:30:08.267: RADIUS:  Vendor, Cisco       [26]  29  
Jun 12 08:30:08.267: RADIUS:   Cisco AVpair       [1]   23 "ssid=Interactive_Test"
Jun 12 08:30:08.267: RADIUS:  Service-Type        [6]   6   Login                     [1]
Jun 12 08:30:08.267: RADIUS:  Message-Authenticato[80]  18  
Jun 12 08:30:08.267: RADIUS:   7D 95 ED 39 3D 12 82 9F 30 8D 1F F4 84 04 43 C9  [}??9=???0?????C?]
Jun 12 08:30:08.267: RADIUS:  EAP-Message         [79]  17  
Jun 12 08:30:08.267: RADIUS:   02 01 00 0F 01 6F 73 70 69 74 65 2D 35 76 68     [?????ospite-5vh]
Jun 12 08:30:08.267: RADIUS:  NAS-Port-Type       [61]  6   802.11 wireless           [19]
Jun 12 08:30:08.267: RADIUS:  NAS-Port            [5]   6   7037                      
Jun 12 08:30:08.268: RADIUS:  NAS-Port-Id         [87]  6   "7037"
Jun 12 08:30:08.268: RADIUS:  NAS-IP-Address      [4]   6   10.132.0.253              
Jun 12 08:30:08.268: RADIUS:  Nas-Identifier      [32]  13  "UFFICIO-AP1"
Jun 12 08:30:08.325: RADIUS: Received from id 1645/128 212.183.164.38:1812, Access-Challenge, len 95
Jun 12 08:30:08.325: RADIUS:  authenticator 8A C9 30 9B 1B 13 20 91 - 4C D6 FE B3 2A 1E F7 85
Jun 12 08:30:08.325: RADIUS:  Vendor, Cisco       [26]  31  
Jun 12 08:30:08.325: RADIUS:   Cisco AVpair       [1]   25  "ssid=Interactive_Ospiti"
Jun 12 08:30:08.325: RADIUS:  EAP-Message         [79]  8   
Jun 12 08:30:08.325: RADIUS:   01 02 00 06 19 20                                [????? ]
Jun 12 08:30:08.325: RADIUS:  Message-Authenticato[80]  18  
Jun 12 08:30:08.325: RADIUS:   31 7D 79 7B C3 67 7E 71 5A FA 53 D4 76 2E 9D A4  [1}y{?g~qZ?S?v.??]
Jun 12 08:30:08.326: RADIUS:  State               [24]  18  
Jun 12 08:30:08.326: RADIUS:   9E B6 71 EA 9E B4 68 7A 8E 86 18 54 AF BD AF 55  [??q???hz???T???U]
Jun 12 08:30:08.326: RADIUS(00001A96): Received from id 1645/128

So i would expect the request to be refused since the "association SSID" does not match the RADIUS one, instead it is acknowledged and the user gets connected.

Relevant configurations follow:

aaa authentication login default group radius
aaa authentication login eap_methods group radius
aaa authorization network default if-authenticated 
aaa accounting nested
aaa accounting update periodic 5
aaa accounting network eap_methods start-stop group radius
!
dot11 ssid Interactive
   vlan 1
   authentication open 
   authentication key-management wpa
   mbssid guest-mode
   wpa-psk ascii 7 01120101551F035F7324DB1194F0ABEE1C0B03175B5C51
!
dot11 ssid Interactive_Ospiti
   vlan 4
   authentication open 
   authentication key-management wpa
   mbssid guest-mode
   wpa-psk ascii 7 15475E1D0725242D262D265D12730301204
!
dot11 ssid Interactive_Test
   vlan 5
   authentication open eap eap_methods 
   authentication network-eap eap_methods 
   authentication key-management wpa version 2
   accounting eap_methods
   mbssid guest-mode
!
interface Dot11Radio0
 no ip address
 no ip route-cache
 encryption vlan 4 mode ciphers aes-ccm tkip 
 encryption vlan 1 mode ciphers aes-ccm tkip 
 encryption vlan 5 mode ciphers aes-ccm tkip 
 ssid Interactive
 ssid Interactive_Ospiti
 ssid Interactive_Test
 antenna gain 0
 mbssid
 no short-slot-time
 speed  basic-1.0 basic-2.0 basic-5.5 basic-11.0
 channel 2457
 station-role root
!
interface Dot11Radio0.1
 description LAN Interactive
 encapsulation dot1Q 1 native
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface Dot11Radio0.4
 description LAN Ospiti
 encapsulation dot1Q 4
 no ip route-cache
 bridge-group 4
 bridge-group 4 subscriber-loop-control
 bridge-group 4 block-unknown-source
 no bridge-group 4 source-learning
 no bridge-group 4 unicast-flooding
 bridge-group 4 spanning-disabled
!
interface Dot11Radio0.5
 description LAN Test
 encapsulation dot1Q 5
 no ip route-cache
 bridge-group 5
 bridge-group 5 subscriber-loop-control
 bridge-group 5 block-unknown-source
 no bridge-group 5 source-learning
 no bridge-group 5 unicast-flooding
 bridge-group 5 spanning-disabled
!
radius-server attribute 32 include-in-access-req format %h
radius-server attribute 4 10.132.0.253
radius-server host 10.132.0.99 auth-port 1812 acct-port 1813 non-standard key 7 131312061E3811242A142A7C79
radius-server vsa send accounting
radius-server vsa send authentication

And here's the output of # show versione

Cisco IOS Software, C1040 Software (C1140-K9W7-M), Version 12.4(25d)JA1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2011 by Cisco Systems, Inc.
Compiled Thu 11-Aug-11 02:58 by prod_rel_team

ROM: Bootstrap program is C1040 boot loader
BOOTLDR: C1040 Boot Loader (C1140-BOOT-M) Version 12.4(23c)JA3, RELEASE SOFTWARE (fc1)

UFFICIO-AP1 uptime is 8 weeks, 2 days, 8 hours, 27 minutes
System returned to ROM by power-on
System restarted at 22:39:10 UTC Tue Apr 16 2013
System image file is "flash:/c1140-k9w7-mx.124-25d.JA1/c1140-k9w7-mx.124-25d.JA1"

Can anyone help?

  • 2
    Are you using ACS or some other RADIUS server? – Dave Noonan Jun 12 '13 at 11:07
  • I'm using FreeRADIUS with MySQL backend – Marco Marzetti Jun 12 '13 at 18:16
  • @MarcoMarzetti, could you add non-standard to the radius-server host line and let me know if this changes the results you're getting? You might have to put the key 7 statement by itself on a different line for this to work. – Mike Pennington Jun 13 '13 at 4:40
  • @MikePennington done, but nothing has changed. BTW i got this error when i changed the value to "SSID=Interactive_Ospiti": parse unknown cisco vsa "SSID" - IGNORE. So IOS understands the attribute and tries to parse it. – Marco Marzetti Jun 13 '13 at 7:08
  • What's your config for interface Dot11Radio? – generalnetworkerror Jun 13 '13 at 8:04
1

Try changing the operator in the freeradius config to "=~" :

ospite-5vh Cisco-AVPair =~ "ssid=Interactive_Ospiti"

  • don't think this could help since "=~" is for comparisons and i want an assignment. Note that the SSID check should be done by IOS not by FreeRADIUS. – Marco Marzetti Jun 14 '13 at 7:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.