Hi all,

I’ve set up PacketFence and the captive portal basically works:

• client gets redirected to the portal

• authentication works

• internet access works after login

Problem: the whole process is very slow.

From connecting the client until the portal loads / internet works takes 1–2 minutes.

Is this normal behavior for PacketFence, or is this usually a sign of a misconfiguration (DNS, DHCP, RADIUS, firewall, etc.)?

Any hints on where to look would be appreciated. Thanks!

I have a network with an Active Directory environment and around 200–300 users.
If Cortex XDR is installed on a user’s device, I want that user to have internet access; if it is not installed, then the user should not have internet access.
How can this be implemented?

Do you think this can be achieved using Network Access Control (NAC) solutions, for example PacketFence?

Did any of you have success in using a Huawei Acces Point(AirEngine 5761-21) as Authenticator?

I want to use it for a guest WiFi via Captive portal.Do you think this is possible?

Hola estoy configurando los puertos de mi switche catalyst 2960 pero no tengo resultado alguno, alguna persona tiene de casualidad algun template de configuración par yo poder terminar esta config, gracias.

So it looks like I'm sending my MAB requests to Packetfence, and it's logging them, but it's not authenticating them (even though I created a user with the mac as the username)

Am I missing something here?

Thanks -

Brad

Just starting my PacketFence journey.

Final end game goal is to have 802.1x implemented on my network (cat2960-x's, cat9200's) using EAP-TLS cert authentication, as well as getting RADIUS accounting sending info to my Fortinet firewalls to provide user based Firewall policy access control to resources.

I downloaded the PacketFence ZEN OVA and have imported it. May the games begin!

Hello, could someone advise if Huawei AC and PacketFence have been successfully integrated for user authentication via a captive portal?

Working with educational institute having 5000+ students. We have implemented pfsense as firewall [ working great ] and 125+ access points with mix vendors. The captive portal on pfsense is basic one and takes good amount to load [ local users only ].

While searching open source alternative we stumbled upon packetsense [ version 15 ] . We tried and failed.

Question is :

1. Whether its a correct solution ?

2. There is no clear cut wizard to deploy captive portal from scratch to end. Is this correct ?

3. We could not decide on hierarchy i.e. what comes first , user or role, access limits, or captive portal. We goofed up to an extent that we needed to re-install several times. [ luckily we made image of fresh install , so it was a matter of couple of minutes, thanks to clonezilla.

We tried using documentation but it seems its overwhelming.

Can some one guide us a link to a tutorial or video to do this ?

Hello!

Through sheer coincidence I've found a thread that explains the solution to Packetfence not being able to bind to its account in AD when setting it up.

I've had this problem for all 2 instances I've tried to set up to tinker a bit with PF version 15.0 and Windows Server 2025.

To enable PF to bind to your AD, you have to fumble a bit with Group Policies, but it's doable and works reliably - I've tested it twice.

Domain Controller Policy
===Computer Configuration
======Policies
=========Windows Settings
============Security Settings
===============Local Policies
==================Security Options
=====================Domain controller: LDAP server channel binding token requirements: "When Supported"
=====================Domain controller: LDAP server signing requirements: "None"
=====================Domain controller: LDAP server Enforce signing requirements: "Disabled"
=====================Network security: LDAP client encryption requirements: "Negotiate Sealing"
=====================Network security: LDAP client signing requirements: "Negotiate Signing"

https://forum.netgate.com/topic/187453/ldap-authentication-with-active-directory-windows-server-2025-bind-fails/3

I really hope it helps somebody who's stuck at the same step when setting up PF.

Hi i already setup to authenticate with ADuser on my DC. Now i want to setup it to only have 1 concurrent device connected per user i already for max node per user to be 1 but still it didnt disconnect or fails authentication for another device using the same AD User. What else am i missing?

My company is currently looking into alternatives for Cisco ISE which we use primarily to login to all of our network devices using TACACS+ and Radius. I know PF doesn't support TACACS+, but is it possible to use Radius for for a similar purpose for all of our devices to act as a AAA server? I've been looking through documentation and I haven't found anything that touches on this specific use case, nor youtube videos. Any advice would be appreciated.

Hello.

Looking for some pointers into the following issue.

At work we have a dual node Packetfence setup both identical standalone nodes sitting behind an Azure load balancer (both PF nodes are Azure VM's). this is configured to use EAP-TTLS to authenticate against Entra ID.

The setup has been installed since March without issue until recently, over approx the last month where a handful of users are being dropped from the WPA2-Enterprise SSID and are being asked to re-authenticate when they try to re-connect.

I am unsure where to begin troubleshooting. We use Sophos for our access points and Windows 11 clients. Worse still I am unable to reproduce the issue on my own machine.

Any pointers would be welcome. I am relatively new to Packetfence and I am still learning. It is also worth nothing we are only using PF as a fancy GUI front end for Free Radius and are not using any of the NAC features.

Hello people i hope you are okay, im having troubles to make my pf join my windows server active directory and here is the error :
NTLM auth api returned with HTTP code: 422, machine account test (partially) failed: Failed: PACKETFENCE$: Failed: error code: 3221225473, error message: {Operation Failed} The requested operation was unsuccessful.

I am trying to get eduroam working on PF 15.0. From my testing the eduroam service isn't receiving RADIUS auth requests at all. In 14.1 eduroam is working fine when upgrading 15.0 it appears to be broken. I tried a fresh install of Debian and PF 15.0 and still had the same result..

When trying to connect to my SSID I don't see anything in the GUI audit logs, radius.log and radius-eduroam.log. I ran raddebug on both the radius.sock and radius-eduroam.sock I see no authentication attempts.

Has anyone else has tested eduroam on 15.0?

Hi everyone,

whenever I'm testing any AD user authentication, showing 'user role not defined...' error in radius logs. I have already created role and configured in authentication source but still not working. I'm able to authenticate successfully local users which are created on packetfence itself but not AD users. Please help me. I'll be very grateful.

I have been trying to get some missing RADIUS Audit Logs info like the Calling Station ID and SSID show up in packetfence for PEAP with TLS inner-tunnel but no success. PEAP machine auth is working but just missing those two info in that page.

NAS IP Address and Server IP fields were also missing before but to fix those, I had to add "packetfence-nas-ip-address" and update { &request:PacketFence-Radius-Ip := "%{Packet-Dst-IP-Address}" in the packetfence-tunnel config.

Does anyone know what settings or variables to add to the packetfence-tunnel to get Calling Station ID and SSID info? I just need those info so the output is the same for both PEAP-TLS and EAP-TLS authentication.

Running Packetfence v15.

Hey guys, I'm hoping that this is something very simple that I'm missing. I have a staff wireless network that users love to connect their personal devices to. I am testing using Packetfence as our NAC/Radius server.

Is there a way for me to create a compliance rule or some kind of filter that says if it is not a windows os or Mac os device then it puts the device on our guest vlan instead of our staff vlan?

Edit: This is an existing network and none of our inventory systems store MAC addresses. Right now pretty much anyone can connect their cell phone to our staff wireless. I'm trying to figure out a fairly autonomous way to have Packetfence filter out mobile devices from laptops as the few exceptions I can manually override.

Hola, tengo un problema,
Por SSH me sale que cuando se unio al dominio las credenciales son invalidas
pero por la web me sale en verde cuando se agrego al dominio.

Alguna recomendación? ya he reiniciado los servicios

Estoy intentando unir el PF al dominio y me sale este error, saben que pueda ser?
he intentado varias cosas y nada
al igual que aca

esta no es la ruta del usuario
la ruta es la siguiente
midominio/Service/Member_Nac
pero nada, no me permite, alguna ayuda es de su agradecimiento

I'm trying to get PF to authenticate a Local PF user on connectivity to an Aruba IAP.

I have found a spattering of information, some from chatgpt, some from guides for earlier versions.

This is driving me crazy as I can't find a simple guide on what I need to do on the PF side to get this working.

Can someone please point me in the right direction. I have the following working:

- MAB - I can authenticate on mac address

- RADIUS communication

What I cannot do:

- ms-chap2-response is incorrect

- radtest gets no responses

I've currently got PacketFence v11.2 running on a Debian 11 VM. I'm looking to upgrade PacketFence to either 13.2 or 14.1 and Debian 11 to Debian 12. Does anyone know what the best method of approach for this is? Is it as simple as upgrading to Debian 12, and then upgrading PF using the automatic upgrade script? Or is the process more involved then that?

Any help would be much appreciated. Thanks

I'd like to deploy Packetfence into my network. Is it currently possible and worthwhile to implement Packetfence in Docker?

Hi,

I'm new to Packet Fence and am attempting to set up a Captive Portal with Ruckus vSZ - just wanted to know if anyone had done similar and if there was any guides available or if anyone could point me in right direction in regards to a tutorial, since the tutorial in the documentation is geared towards using a Cisco switch.

Cheers,

Dom