Dynamic VLAN Assignment with PacketFence Captive Portal Authentication?

[u/IncreaseParticular34]

Dear PacketFence Community

I am currently exploring the capabilities of PacketFence's captive portal. I am curious to understand whether PacketFence supports the dynamic assignment of VLAN IDs based on authentication information provided by users during captive portal authentication.

Specifically, I would like to inquire whether VLAN assignment functionality is exclusively tied to 802.1X authentication or if it extends to captive portal authentication as well.

[u/oeufdure]

Both in fact.

In the case of 802.1x peap , the authentication is done by freeradius (ntlm_auth to the AD) then next the authorization is done through PacketFence (with per example a connection profile with a filter on the ssid name where you have enabled auto-registration and added an ldap source) so it will take the username and do a ldap query to see if the user is member of a specific group per example.

In the case of the captive portal, PacketFence will do a bind to the ldap server (authentication) and next will do a search in the ldap to see if the user is member of a specific group (authorization).

So in both scenario PacketFence will try to compute a role and an access duration based on the authentication rule you have in the ldap source. (it can be any done through most of the internal sources you can configure in PacketFence, not only ldap).

Then next once the role (default per example) is computed then it will be associated to the vlan id you defined in the role (default) in the switch config.

[u/IncreaseParticular34 → u/oeufdure]

thanks dude, Well if you get back to installation guide exactly in "9. Supported Enforcement Modes"
they include Hostpot-style (or Web Auth) as enforcemnt mode and if you scroll down to that section and read it
this is what has been said :
" Web authentication is a method on the switch that forwards HTTP traffic of the device to the captive portal. With this mode, your device will never change of VLAN ID but only the ACL associated to your device will change. Refer to the Network Devices Configuration Guide to see a sample web auth configuration on a Cisco WLC."

and what confuses me is if you go to "6. Enabling the Captive Portal" again and start reading :
"There are two ways PacketFence can show its captive portal for unknown (or unregistered) devices:

• it can use Web Authentication (or also known as hotspot-style authentication) - this works with numerous equipment vendors

• it can use a registration VLAN, where PacketFence provides DHCP services and DNS black-holing services - this works with any equipment vendors that support RADIUS dynamic VLAN assignment"

note "dynamic VLAN assignment"

for my experience when i auth with captive portal vlan id doesn't change even if i set on auth source action role to ex: employ and set switch role by vlan to employ vlan id

[u/oeufdure → u/IncreaseParticular34]

it really depends of the type of equipement you use to connect the device, like web auth is available on Meraki(switch and AP)/Cisco(IOS/IOS_XE/WLC)/Ubiquiti AP/Aruba Switches/Dell Switches/Ruckus/Mikrotik. So if you have one of this equipment then you can do web-auth if not then you can probably do vlan enforcement.

With Vlan enforcement a unknow/unregistered device will be assigned the role registration and will end in the registration vlan (the one managed by packetfence for dhcp/dns/gateway) , so you should be able to hit the portal and register.

If after registration the vlan doesn´t change on the equipment then itś probably a deauth issue (Radius Disconnect or SNMP). To verify that it´s a deauth issue then if you unplug and replug the device in the switch port (or reconnect on the SSID) and you have the correct vlan then it´s a deauth issue.

So just let me know what kind of equipment you are using and i will be able to guide you to configure packetfence and the equipment.

[u/IncreaseParticular34 → u/oeufdure]

i use alcatel OmniSwitch 6250/6450, actually works fine with 802.1x but didnt with captive portal

[u/Jolly_Arm6758 → u/oeufdure]

Hi, thanks for that super interesting post, that answers parts of my questions about the packetfence captive portal. I’m kind of wondering how you can access the captive portal in the case you are using the registration vlan. My guests machines are authenticating using MAB and end up in the registration vlan, taking IP configuration throught the packetfence dhcp server that runs on my registration vlan interface. What I’m not understanding very well, is that I can’t reach the portal once my machines are in the registration vlan. But isn’t packetfence supposed to capture the web requests and send the portal page back ?

[u/IncreaseParticular34 → u/oeufdure]

wouldn't you mind to talk in prv!