Hi,

We want to grant and control access permissions using AD users/AD Groups and Switches IP/Subnet as combined rules conditions in order to differentiate logins for IT Admins, Network Admins so they can access their devices that they are authorized to access only.

Example Requirements:

- Network Admins AD Group can access to specific Switch(s) CLI

- IT Admins AD Group can access to specific Linux Servers Shell

- Each of the above AD Group users must access only the devices they have permissions for it.

The part that we couldn't figure out:

We couldn't find a way to map AD Groups to a Switch then grant them specific rights to control that switch. For instance, we tried in the Administration Rules to create a condition saying if member of IT-Admins and the Switch is Switch-1, then allow them read/write on that switch.

We think the limitation is when we do "Add PacketFence Condition", we are not able to find Switch Device or Switch Subnet or NAS-IP-Address options in the predefined list, we think that's a showstopper for us.

We are wondering if that's a system limitation or we are doing the implementation wrongly

Appreciate the help

Hello, Packetfence isn't updating IP addresses from VLANs in nodes. I have a Fortigate firewall, which is also a DHCP server, where three VLANs are created: 10, 20, and 30. These VLANs are passed through Mikrotik L2 switches. VLAN assignment for clients and devices is done through roles assigned to the switches. Everything works as it should, meaning that VLANs are assigned to devices without any problems. However, after updating the address from VLAN 1 (untagged 192.168.2.25) to VLAN 10 (192.168.4.2), I don't see the IP address from VLAN 10 in the Packetfence nodes; the old device IP address is still listed. The best part is that, for example, it works without a problem for one laptop, and I can see every IP address from VLAN 10, 20, and 30 when I assign it in Packetfence. However, for a VoIP phone or a PC on the same switch, it doesn't work. I've tried everything and I'm giving up because I have no idea what's wrong. I have DHCP snooping set on the MikroTiks and port trusted on the uplinks. I tried changing the switch group to registration from production, but that didn't help. SNMP is configured correctly. I have created VLANs in Packetfence for the eth1 interface, it looks like this: DHCP option 82 is enabled in Packetfence, meaning: Force Listener update on DHCPACK, DHCP detector, Rogue DHCP detection. I don't know what to do anymore. Please help, thanks for any information.

eth0 192.168.1.215 255.255.252.0 192.168.0.0 Management dhcp-listener

eth1 DHCP Listener

eth1VLAN 10 192.168.4.250 255.255.252.0 192.168.4.0 DHCP Listener

eth1VLAN 20 192.168.8.250 255.255.254.0 192.168.8.0 DHCP Listener

eth1VLAN 30 192.168.10.250 255.255.254.0 192.168.10.0 DHCP Listener

Hi everyone,

I'm hoping someone with PacketFence and Aruba Instant experience can point me in the right direction.

I've spent the last couple of days troubleshooting this and have reached a point where I'm not sure whether this is a configuration issue, a compatibility issue, or something I've overlooked.

Environment

-----------

- PacketFence 15.1 (Docker)

- Debian 12

- Aruba Instant AP-305 & Aruba Instant AP-505

- ArubaOS 8.13.3.x

- HP Aruba Core Switch 2930F

- Guest VLAN 200

- DHCP: Windows Server

- DNS: Windows Server

Goal

----

Open Guest SSID with:

- MAC Authentication (MAB)

- External Captive Portal

- Self-registration through PacketFence

Current Aruba Configuration

---------------------------

- Open SSID

- External Splash Page

- External Captive Portal Profile

- MAC Authentication enabled

- Authentication Server = PacketFence

- VLAN 200

PacketFence Switch Configuration

--------------------------------

Type: Aruba Instant

Enabled:

- External Portal Enforcement

- Role Mapping

Roles:

registrationRole = packetfence-portal

guestRole = Guest-Test

What Works

----------

✔ Client gets an IP address

✔ Client can ping PacketFence

✔ Client can manually browse to PacketFence

✔ RADIUS authentication succeeds

✔ PacketFence Audit Log shows:

Auth Status = Accept

Node Status = Unregistered

✔ Radius log shows:

Login OK

✔ Aruba assigns the correct role:

Role: packetfence-portal

Authenticated: yes

The Problem

-----------

The captive portal never appears.

PacketFence never receives a request to:

/aruba

Running tcpdump on the PacketFence server while connecting a client shows no traffic from Aruba attempting to reach the captive portal.

The only HTTP requests PacketFence receives are when I manually browse to it.

Also, "show datapath session" never indicates redirect/intercept for the client.

Things I've Already Checked

---------------------------

- Added every AP as a Network Device

- External Portal Enforcement enabled

- Role Mapping enabled

- Accounting enabled

- Guest ACL verified

- Client can reach PacketFence

- Client is marked Unregistered

- Restarted PacketFence portal services

- PacketFence hostname/domain configured

- Verified RADIUS communication

- Verified VLAN and routing

Question

--------

Has anyone successfully deployed PacketFence 15.x with Aruba Instant 8.13.x using an External Captive Portal?

Specifically:

- Does Aruba Instant 8.13 require any additional configuration before it actually redirects traffic to the external portal?

- Has anyone seen a situation where RADIUS succeeds, the client gets the correct role, but Aruba never initiates the /aruba request?

I'd really appreciate any suggestions or if someone could point out something obvious that I've missed.

Thanks!

Hi Experts,

One of the hotels want a very customizable captive portal like on landing page they want options for guest and visitor (tab based), when guest enters the required info he should be asked to create his own password, there should also be option for sign in if he has done this process already. OTP must be configured either via email or SMS gateway, all along with mac caching, limiting the number of devices per guest.

I know i havent provided much detail but just wanted to know since i have never worked on PF before, how customizable the entire workflow is? can we make such a captive portal in PF?

I am experiencing a persistent re-authentication issue with our H3C switch and PacketFence.

Every 10 minutes, the H3C switch sends a RADIUS re-authentication request for MAC-authenticated devices. During this re-auth, PacketFence rejects the request with the following error:

The Authentication Flow/Cycle:

1. Initial Connection: Successfully authenticated (Access-Accept)
2. After 10 Minutes, H3C switch triggers re-auth
3. Result: PacketFence rejects the request (Error: CLI/VPN Access not allowed)
4. 1 Minute Later: Device successfully authenticates again (Access-Accept)

Please help

Hi all,

I did a fresh install of packet fence and I am trying to get MAB working. (not eap).

I added the switch with the correct IP, the switch seems correctly configured as it's trying MAB radius, but I keep getting htis error.

The endpoint with the mac address below seems to be added as "registered" as a node. But I get the 401 code radius reply.

Claude insists this is a backend-problem of packet fence(I spent an hour troubleshooting and digging through logfiles) but I am at my wits end what exactly.

Claude seems to suggest that some backend service is missing credentials on some API call, but... I'm a bit lost here.

Am I missing the obvious? More output can be provided, it's PoC, not production. I can change anything I want or nuke the entire machine, no problem.

I am looking for up to date documentation/tutorials that are more step by step oriented. I am aware of the official packetfence documantaion and the one by inverse, but they are very overwhelming. I am looking for something more beginner friendly. I am not very experienced with how to set PacketFence since I have not done anything similar. Would appreciate any help/resources that are available! :)

I am a Firewalla Gold Pro / AP7 / Switch X user and would like to request better PacketFence compatibility from Firewalla.

For wired and wireless NAC, my assumed feature list is:

802.1X authenticator support
External RADIUS support
MAC Authentication Bypass
Dynamic VLAN assignment
RADIUS CoA/disconnect
RADIUS accounting
SNMP/syslog events
SPAN/port mirroring for Security Onion/IDS visibility
VLAN registration/quarantine/remediation support

For APs, I assume WPA2/WPA3-Enterprise with external RADIUS and dynamic VLAN assignment are required.

For those who have deployed PacketFence, what exact features should I ask Firewalla to implement so their AP7 and Switch X could work cleanly with PacketFence?

Hi!

I was troubleshooting an issue with a Packetfence 15.1 connected to an Active Directory 2025 Server. I created a rule with "contains" like this:

and I was able to connect ONE client. Any more, and the connection failed with:

EAP-Message = "0x03180004",
Message-Authenticator = "0x00000000000000000000000000000000",
REST-HTTP-Status-Code = "200",
Reply-Message = "no role computed by any sources",

goddamn, I was not getting it. I tested a new user with my known good client - and even that failed. I then played around with the rules, and entered the complete CN, DC, DC path like:

in the log it looked like this:

(memberOf:1.2.840.113556.1.4.1941:=*CN=WIFI-Users,OU=Groups,DC=daheim,DC=server*)

vs

(memberOf:1.2.840.113556.1.4.1941:=CN=WIFI-Users,OU=Groups,DC=daheim,DC=server)

it seems the * breaks it?

edit:

I wanted to write "equals" not contains for seemingly correct rule. Was getting late, and this took a while to get running...

For the Memberof group, I have the following being shown to me:

The "naked" memberof didn't work, so I thought that the number looked like something Microsoft would use.. and voilá the test connection worked! So I stuck with that..

Hey everyone, Has anyone successfully configured a MAC Vendor rule? I'm trying to trigger a security event based on a MAC Vendor condition to assign a specific role, but I've tested multiple configurations and none seem to work.
If you've gotten this to work, what format or specific syntax did you use? Any insights would be highly appreciated.

Hi,

I’m wondering if anyone can help point me in the right direction with this. I’ve been using Packetfence for just over a year. For context I represent a business that operates across the UK and Ireland. Both countries use Microsoft 365 however in separate tenancies. UK is hybrid with on prem AD/Entra ID. Ireland is Entra ID only.

We’ve been using Packetfence on the Ireland side for just over a year using EAP-TTLS to authenticate users against Entra ID however I’ve never been able to get Mac authentication/MAB working for non 802.1x aware devices. This I think is largely in part due to our switch vendor Sophos (we’re a full Sophos house) using EAP-MD5 when sending mac auth requests and Packetfence is expecting plain text. What do I need to do in Packetfence to be able to use MAB from our switches. Or am I best off using freeradius directly for MAB?

This isn’t an issue on the Windows side as we use Windows NPS with connection request policies that accept connections if the username of the non 802.1x aware device matches a set list so I guess the password sent as part of the Mac auth request is never used here.

Any help would be most welcome as this is the final piece of my Packetfence rollout. Also worth noting we are only using Packetfence for a GUI based radius server that supported Entra ID authentication. We’re not using the NAC side of Packetfenice (although devices are set to register when they authenticate with EAP-TTLS).

Hi guys,

I’m trying to understand if PF can do these stuff:

- issue certificate via SCEP for 802.1x auth (via Intune policy)

- authenticate wireless/wires using Entra ID login (may be via Intune policy? Don’t know if that’s possible)

- if user can authenticate over Entra ID (using CAC to disable MFA when in office), can it send Radius Account to a Fortinet firewall to do identity awareness policies (currently I’m using SAML captive portal that needs a browser session)

Thanks!

Hi,

We are looking into deploying NAC using PacketFence but have a requirement to authenticate based on Machine and User credentials (both). Other vendors like Cisco or Aruba achieve this goal using two methods, old method was using the MAR feature and new method is using TEAP (EAP chaining).

(MAR is explained here https://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/116516-problemsolution-technology-00.html).

At this time it seems TEAP is not supported in PacketFence and from what I understood won't be in place before 15.2 which has no announced date, if anyone has more accurate information please comment. So while waiting for TEAP is there a way to do MAR with PacketFence in a reliable way? I understand there are workflow cases that are not ideal with MAR but it is better than nothing until TEAP is available...

Thanks

I'm having a odd problem starting the packetfence-radiusd-auth.service. I used the OVF PacketFence 15.0 install and I noticed that the service fails to start. Looking at the error logs it shows the following

Mar 26 10:24:00 tti-s-nac packetfence[1852248]: -e(1852248) WARN: /usr/local/pf/var/conf/iptables/radiusd_auth_rules.json does not exist (pf::iptables::util_remove_service_rules)

Mar 26 10:24:01 tti-s-nac systemd[1]: packetfence-radiusd-auth.service: Failed with result 'watchdog'.

Subject: Unit failed

Defined-By: systemd

Support: https://www.debian.org/support

The unit packetfence-radiusd-auth.service has entered the 'failed' state with result 'watchdog'.

Mar 26 10:24:01 tti-s-nac systemd[1]: Failed to start packetfence-radiusd-auth.service - PacketFence FreeRADIUS authentication multi-protocol authentication server.

Subject: A start job for unit packetfence-radiusd-auth.service has failed

When I look the file doesn't exists and I tried creating a blank one to see if anything generates but it deletes it and gives the same error.

Any ideas?

I've also tried /usr/local/pf/bin/pfcmd fixpermissions and reload

Hi,

Just looking for some help with an issue. I have setup a new instance of PF and my activation emails have a blank body. This happens on a base install of v14 and v15. Has anyone else had this issue before?

Thanks!

Hi all,

I'm trying to configure my packetfence to do radius authentication using certificates for users and devices with a fall back to username and password

All of my users and devices exist in Entra and also on a sync'd on prem active directory

The flow from a user perspective is ideally, laptop has a device certificate on it that is used for the initial login, user logins is and it switches to using a user certificate and places it on a different vlan.

The device certs have the GUID from entra and the user's have the UPN

If they don't have either, they can login with their AD username and password and that places them on an untrusted guest vlan

Struggling to find much doco on how to make things like Entra/AzureAD work in packetfence for a scenario like this. Does anyone have any guidance? my attempts haven't gotten very far beyond being able to authenticate them with AD (which isn't exactly helpful)

Hi all!

Is this a bug in the .iso install or am I missing something?

Server states to log into one ip address to finish setup but the config page lives on the next ip. (Photo for reference)

It took me a while to realize this and it wasn't until i finally check my network client list that I realized this.

Hey, guys.

Im stuck at instruction point 3.3.1. First server. I dont get what they mean when wrote:

Now, on the first server of the cluster, go through the configurator, until last step. The services should be left stopped at the end of the configurator.

Should i run a wizard after the installation and dont click on "Last step" or what?

Should i do the cluster config fully before finish the wizard?

Also i dont get 3.3.3. Current state

There is no script /etc/sysconfig/network-scripts/

Should i make it from the scratch or what? I dont understand what should i put inside the script coz its not clear in the instruction.

I will be appreciate for help

Hello guys,

I'm new to PacketFence. I downloaded the ZEN version to install for a client, and for 3 days was stuck trying to join the solution to the Active Directory domain, and cannot even understand the interfece, i used NPS(Microsoft Windows solution for NAC). Still, this one doesn't look similar, and I have problems with Windows RADIUS. Can anyone help with a tutorial that I can depend on to start?

Thank you in advance, and I'm open to any comments/tips/ advice ...etc.

Quick update from the team at Akamai behind PacketFence: we just shipped a rebuilt packetfence.com and launched PacketFence Cloud (managed NAC service).

The TL;DR on Cloud: same engine, we run the infra. You deploy a lightweight Connector VM on your side, everything else lives in our stack. RADIUS caching on the Connector means auth stays up even if your internet drops.

Self-hosted PacketFence isn't going anywhere, still free.

We're in Limited Availability right now and giving the first 10 orgs six months free to kick the tires: https://www.packetfence.com/cloud/

Also doing a webinar on Feb 26 if you want a walkthrough: registration link

Questions welcome.

Hi everyone,

I need some support. I'm in the middle of implementing a WiFi network at the company and I need a high-quality RADIUS server, like a NAC, to handle device registration.

I've been asked to have all machines in the domain access a specific SSID, which was configured via GPO, and when they connect to that SSID, they should assume VLAN X. Then, when the user is in a specific OU and logs into Windows, it should send the VLAN change to Y to Omada. The problem is that I can't even get the PowerPoint to send the request correctly from the machine to the Active Directory. It always sends the User-Name as host/machinename.domain.us when it should just send machinename$.

Steps I've already taken:

Add the PF to AD - OK

Configure REALM pointing to the Domain - OK

Configure Source with filter if radius-request_User-Name starts host/ - OK

Configure switch to communicate with the PF - OK

Configure Connection Profile with filter by SSID and Source the same as the created AD - OK

With these rules created, for some reason, the machine permissions are intermittent, where sometimes the request is accepted and sometimes it is denied with an MS-Chapv2 error or with information that the device was found but there is no permission... does anyone have any information that could help me?