topic Re: How can I dow a Radius overwrite to WING7.6.3 in Security & Access Control

How can I dow a Radius overwrite to WING7.6.3

JohanHendrikx — Wed, 07 Jul 2021 20:12:24 GMT

I have a two WING controllers (VM appliances) configured as a cluster.

The controllers are configured as radius client in EAC

The WLAN I connect to, must do a MAC address athentication. So far its works. But the client isn't placed in the right vlan.

How can I achieve a radius overwrite of the vlan.

Re: How can I dow a Radius overwrite to WING7.6.3

Tomasz — Mon, 12 Jul 2021 21:41:10 GMT

Hi Johan,

What attributes are you sending from EAC to WiNG? Is there Tunnel-Private-Group-Id? Secondly, under WLAN basic settings, where VLAN is chosen (single or pool), there’s a checkbox in the good-ol Flash GUI to allow dynamic VLAN authorization. I didn’t play with the new GUI yet so you can always check if ‘radius vlan-assignment’ is seen in the CLI under your WLAN object config context.

Please remember to add your target VLANs to AP’s ge1 switchport trunk allowed vlan list.

Hope that helps,

Tomasz

Re: How can I dow a Radius overwrite to WING7.6.3

JohanHendrikx — Tue, 13 Jul 2021 19:19:45 GMT

Tomasz, I tried serveral attributes. Now Iám testing with Extreme NetLogin - VLAN ID.

Where caan I find the setting Tunnel-Private-Group-id?

I use single pool vlan and the setting Radius vlan-assigment is configured unther the wlan object.

Re: How can I dow a Radius overwrite to WING7.6.3

Tomasz — Tue, 13 Jul 2021 20:20:21 GMT

Hi Johan,

For dynamic VLAN assignment you want the EAC to send the attributes like this (you can verify by highlighting your end-system row under Authorization column):

I mean, the ‘Tunnel-’ trio.

This can be chosen under Switches tab within EAC configuration (RADIUS Attributes To Send):

If this is set (and device is granted relevant EAC Profile and ‘Accept Policy’ - which is a policy mapping in fact) you should see appropriate Tunnel attributes being sent as your End-System table indicates.

Then, if your devices are still not getting their VLAN, it might be something along the way or WiNG config itself. But I’d review that part first.

Hope that helps,

Tomasz

Re: How can I dow a Radius overwrite to WING7.6.3

JohanHendrikx — Thu, 15 Jul 2021 13:16:46 GMT

Thomasz,

Device is set to Radius attributes to send on RFC 3580 - VLAN ID

I see only 2 attributes..

Tunnel-Private-Group-Id isn't set.

Re: How can I dow a Radius overwrite to WING7.6.3

Tomasz — Thu, 15 Jul 2021 17:16:39 GMT

Hi Johan,

It seems there’s no VLAN ID set in the Policy Mapping that is chosen for a given NAC Profile.

Please see here, “VLAN [ID] Name” value has to be set:

Hope that helps,

Tomasz

Re: How can I dow a Radius overwrite to WING7.6.3

JohanHendrikx — Thu, 15 Jul 2021 20:54:11 GMT

Tomasz,

Check. this was the solution.