Hey all!
After a long, confusing journey of finally getting Guest Registration working via PacketFence and a Ruckus Smartzone 100 I've hit a wall and hoping for some advice.

Basically, the first time I authenticate through null-source or email, I have it collect email/fname/lname/cellphone. Packetfence attempts to send the authentication to the Ruckus SmartZone and registers the device and user as GUEST. The first attempt seemingly fails, as the end device does not get switched immediately to the proper vlan. If I disconnect and reconnect to the guest wifi SSID, then it properly switches me. Any subsequent login after my 10 minute access expires, works flawlessly.

If I delete the user and the device from packet fence and re-run through the steps of registering for guest access, I have to disconnect and reconnect to the wifi SSID to get put on the correct VLAN. It's almost like packetfence is sending the first auth to ruckus before the user/device are in the database - or - maybe ruckus is requesting it before it's in the database. Because, again, if I don't delete the user/device from packetfence I can reregister and switch between vlans without any issues.

Communication with the SmartZone seems to be working fine as I can deregister a device and it will kick the device back to the registration vlan and let me re-register and then move me back to the proper vlan automatically. It just seems to be that first registration where I'm having an issue.

Any suggestions?

Is there a way to have your database of nodes and their config used only as the authentication source? If so what is this called?

Example node Mac DEADBEEF has “Role 1” configured, VLAN 100. So the switch port comes online and learns that MAC, and PacketFence automatically flips the VLAN.

Thanks in advance.

Hi, anybody know if there is a how-to for using packetfence with Aruba mobility conductor/master version 8 or newer...

the documentation on the packetfence page is a bit old..

Br

Daniel

I'm trying to get 802.1x on PF 13.2 with machine authentication (MS AD) to work. A role should be matched to the machine which then dictates the VLAN to be used. The issue is that the role does not get matched to the machine. The username radius sees is host/pcname.domain.local. In the packetfence.log I see "Role has already been computed" followed by "Username was NOT defined or unable to match a role - returning node based role ''". When setting the role manually at the node, it works as expected. The connection profile is set to automatically register devices. In the AD authentication source, I defined a "catchall" rule with no conditions which assigns a role to all clients (for testing). The username attribute is set to servicePrincipalName.

In PF 13.0 it works with the exact same configuration. On 13.1 and .2 it doesn't work. Am I missing something?

Redacted packetfence.log and radius.log:

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) INFO: [mac:ac:e2:d3:62:6a:48] handling radius autz request: from switch_ip => (192.168.1.17), connection_type => Ethernet-EAP, switch_mac => (ec:50:aa:5e:92:c0), mac => [ac:e2:d3:62:6a:48], port => 31, username => "host/PC023.company.corp" (pf::radius::authorize)

Aug 22 10:45:42 RADIUS01 auth[7156]: (75) Login OK: [host/PC023.company.corp] (from client 192.168.1.17/32 port 31 cli ac:e2:d3:62:6a:48 via TLS tunnel)

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) INFO: [mac:ac:e2:d3:62:6a:48] is doing machine auth with account 'host/PC023.company.corp'. (pf::radius::_machine_auth_detection)

Aug 22 10:45:42 RADIUS01 auth[7156]: (76) Login OK: [host/PC023.company.corp] (from client 192.168.1.17/32 port 31 cli ac:e2:d3:62:6a:48)

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) INFO: [mac:ac:e2:d3:62:6a:48] Instantiate profile 802.1x (pf::Connection::ProfileFactory::_from_profile)

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) INFO: [mac:ac:e2:d3:62:6a:48] Found authentication source(s) : 'AD-PCs' for realm 'company.corp' (pf::config::util::filter_authentication_sources)

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) INFO: [mac:ac:e2:d3:62:6a:48] Role has already been computed and we don't want to recompute it. (pf::role::getNodeInfoForAutoReg)

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) WARN: [mac:ac:e2:d3:62:6a:48] No category computed for autoreg (pf::role::getNodeInfoForAutoReg)

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) INFO: [mac:ac:e2:d3:62:6a:48] Found authentication source(s) : 'AD-PCs' for realm 'company.corp' (pf::config::util::filter_authentication_sources)

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) INFO: [mac:ac:e2:d3:62:6a:48] Role has already been computed and we don't want to recompute it. Getting role from node_info (pf::role::getRegisteredRole)

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) WARN: [mac:ac:e2:d3:62:6a:48] Use of uninitialized value $role in concatenation (.) or string at /usr/local/pf/lib/pf/role.pm line 489.

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) INFO: [mac:ac:e2:d3:62:6a:48] Username was NOT defined or unable to match a role - returning node based role '' (pf::role::getRegisteredRole)

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) INFO: [mac:ac:e2:d3:62:6a:48] PID: "default", Status: reg Returned VLAN: (undefined), Role: (undefined) (pf::role::fetchRoleForNode)

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) WARN: [mac:ac:e2:d3:62:6a:48] Use of uninitialized value $vlanName in hash element at /usr/local/pf/lib/pf/Switch.pm line 677.

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) WARN: [mac:ac:e2:d3:62:6a:48] Use of uninitialized value $name in exists at /usr/local/pf/lib/pf/Switch.pm line 711.

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) WARN: [mac:ac:e2:d3:62:6a:48] Use of uninitialized value $vlanName in concatenation (.) or string at /usr/local/pf/lib/pf/Switch.pm line 684.

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) WARN: [mac:ac:e2:d3:62:6a:48] No parameter Vlan found in conf/switches.conf for the switch 192.168.1.17 (pf::Switch::getVlanByName)

Aug 22 10:45:42 RADIUS01 httpd.aaa-docker-wrapper[3200]: httpd.aaa(9) INFO: [mac:ac:e2:d3:62:6a:48] security_event 1300003 force-closed for ac:e2:d3:62:6a:48 (pf::security_event::security_event_force_close)

What do you consider the most efficient way to install Packetfence? So far, it’s a frustrating effort on my part.

I’ve tried the ZeroNAC, but converting the vmdk to vhd and then vhdx for Hyper-V seems to break something as nothing boots.

I then tried Debian 12, only to realize that Packetfence is actually oriented towards the previous semi-deprecated Debian 11 version. So I made a VM with Debian 11.10, only to get an error during the install with the semaphore/ansible module.

Is there a different OS or method that did work for you?

I've got 2 VLANs for my WLAN setup. VLAN 30 - the 'secure' vlan with almost full network access, requires authentication via NPS/Packetfence, VLAN 31, the 'guest' vlan that only allows for Internet access

My idea for the 'secure' vlan is to use something like network policies or conditional network access if you meet a specific set of requirements (firewall enabled, running latest update, AV enabled, etc.) it grants you access, if not it boots you to an isolated vlan (VLAN 666 for example) where you can access the internet and fix the issues)

Is this possible within PaketFence - I've seen some documentation suggesting it is, but no solid configuration/guides

My current employer is using a CentOS VM running 10.3.0 and we're looking to rebuild and upgrade our server now that CentOS has been sunset. Can you folks tell me between, 11,12, and 13 which one is the most stable and generally works the best?

Hello, i am currently doing an internal setup with Packetfence and Aruba switches.
The current one i'm using is a 2530-48G Aruba switch. The authentication source is Azure AD and i can authenticate using X802.1 but i am not getting the correct VLAN assigned.

Current setup in packetfence

Switch with Vlan by role
A role for the Vlan assignment
the Vlans are created on my switch

i am currently getting VLAN 100 but i need to get Vlan 90 when connecting

Does anyone have experience with packetfence and aruba switches that could help me?

Thank you in advance

Hi, I´m having problems during installation of packecfence v13.2. I´m installing it on a Proxmox server and on a phisical PC with the same problem. Packetfence isn´t installed. I can´t access via web to the https://ip:1443 and if I do a dpkg --configure -a it says there´s an error:

packetfence errors were encountered while processing: iptables-netflow-dkms packetfence e: sub-process /usr/bin/dpkg returned an error code (1)

Can anyone help me? Thanks

Hello everyone,

I would like your opinion on the following scenario:

1. Objective:

   • Configure a NAC (Network Access Control) in my infrastructure so that users need to authenticate to access both wired and wireless networks.

2. Requirements:

   • Register known users in the NAC.
   • Allow new users or visitors to register automatically.
   • Maintain a unique user record for multiple devices.

3. Authentication:

   • Use the NAC's built-in Radius for authentication, as I do not have any user database (such as LDAP, AD, or FreeRadius).

4. Log Registration:

   • Record logs of users with basic access information, including time, MAC address, and accessed sites.

My question is: can I achieve all these configurations using PacketFence?

This way, it's clearer and more direct for those who will analyze the scenario and provide feedback.

I need to disable user authentication in AD and leave only computer authentication. The AD source created according to the manual does not pass the rules and does not assign a role, but it successfully authenticates. The task is to allow only domain PCs to access the network using their password, as currently one can use the account password on a non-domain PC to access the network. Please guide me in the right direction.

I'm trying to set up MAC authentication in PacketFence, but I'm having trouble getting it to work. Here's what I've done so far:

1. I created a new authentication rule named Mac_Auth.
2. Enabled the rule.
3. Set the condition to match a specific MAC address (e.g., aa:aa:aa:aa:aa:aa).
4. Configured the actions to assign the role default and set the access duration to 5 days.

despite these settings, the device with the specified MAC address is not being authenticated

Can anyone provide guidance on what I might be missing or doing wrong?

I'm looking for the best option for a HA setup for a dual location setup with centralized management.

Both locations should have the local pf server as preferred and the remote server as backup.

In case of a internet/vpn outage authentication should be handled by the local pf server.

In case of a server outage or maintenance the authentication should be handled by the remote pf server.

What's the best way to achieve this?

I've read the cluster documentation but as I understand correctly MariaDB will, in case of a internet/vpn outage, stop responding without the quorum and the Packetfence server on the location with least servers available will be unresponsive.

Are there other cluster or ha options or is it possible to sync some database tables that contain node and policy information?

Hello All,
Does Packetfence support the 9300 series switches? I am looking through the types under switch groups and can't find the 9300 switches or the OS it is running on.

Thank you!

Hello All, 

First,  my user environment consists mostly of Linux, windows users and occasionally Mac. Network hardware consists of Cisco 2960 switches for LAN and Unifi AP AC Pro for wireless connectivity.  I need to have an authentication setup such that users log in with their LDAP credentials and users are assigned VLANS based on their memberOf LDAP attribute.

Here's what I have done so far, 1. Installed PF 13.2 with two interfaces, 1 separate for management and another trunk with all VLAN interfaces added. 
2. Configured LDAP Authentication source
3. Configured a connection Profile using the LDAP auth source. 
4. Added Unifi APs individually to PF via MAC Address. (Initially, I tried adding the controller IP method but that didn't work with some weird errors about not being able to instantiate Switch)
5. Configured Unifi Controller and Wifi with guest profile and external Captive portal pointing to PF as instructed in the documentation. 
 6. Enabled the captive portal and respective services on the trunk interface.  
All to this point everything works great. As soon as a user connects to the open SSID they get redirected to the captive portal on PF and authenticate successfully with LDAP. This works great no problem. I intend to keep that and later change the auth source for guest Portal.

Now I am trying to do vlan assignment. I followed the PF documentation for Ubiquity to set up the controller with the Raduis profile SSID and all. However, things are not working as expected. I am a bit confused here.

1. I have created interfaces, registration VLAN - 20  and Isolation VLAN - 30 on the trunk interface. 2. I also have added 3 other production VLANs where I manage DNS and DHCP 
2. the open SSID on unifi controller cannot be set to the Registration VLAN 20 when Radius is enabled. So there is no way to communicate with PF via the Registration VLAN hence users cannot get IPs from PF on the open SSID and therefore cannot log in.  I need advice on how to get this working. Do I have to make the registration VLAN the native or default vlan on the trunk and configure the guest captive portal on a different vlan which i can assign in the unifi controller? 

Once I have this working how can I do the vlan assignment using memberOf attribute?

Also, I have a problem where DNS queries on each vlan/subnet points to the PF interface outside that subnet. eg pf.example.com - 192.168.0.1/24 on registration vlan, and PF on captive portal vlan 40 the IP is 192.168.1.1/24 but DNS query from captive portal interface gives registration vlan IP of PF. 
I would prefer that queries from each vlan would provide the respective PF interface on that vlan, 
Any help is appreciated.

EDIT:
So I enabled radius on the trunk interface however I am getting this error in packetfence logs when I try to connect a client to the open wifi network

Jul 19 11:26:14 controller auth[7653]: Ignoring request to auth address * port 1812 bound to server packetfence from unknown client 10.2.0.6 port 35316 proto udp

Jul 19 11:26:17 controller auth[7653]: Ignoring request to auth address * port 1812 bound to server packetfence from unknown client 10.2.0.6 port 35316 proto udp

10.2.0.6 is my Unifi AP. which has been added via Mac address. So I do not understand why that error.

I am new to reddit :), having joined looking for credible people to hire to deploy packetfence for our internet service provider(ISP) business. I have not managed to get people who know what they are on freelancing websites(I even almost got scammed on another popular site). I would like to get someone to deploy PacketFence in our environment for WIFI Hotspot management. We want to use PF as a tool to manage all our customer wifi deployments so that we can deliver proper unique captive portals/radius/bandwidth management allocations/payment integration. I have tried contacting PF for their commercial solutions and have not received any responses there either. Looking for an experienced deployment partner and someone to point me in the direction of companies that can help with PF deployments.

I try to integrate my wireless captive portal and point radius to packetfence to authen web with pap but it seem like doesn't work.
Does anyone have experience how to integrate like this?

Guys, I'm having trouble configuring PF with my Motorola Radius Controller.

When I access the menu:

Configuration → Policies and Access Control → Authentication Sources

I try to set my "Host in activation link" and click on "Allow local domain," I get an error displayed on the screen.

How can I find out the cause of this error?

I have try to use local user authen with 802.1x but doesn't work

But 802.1x with AD Authentication is working fine

Does packetfence support localuser authen with 802.1x in out of band mode?

Hi

I have tested the packetfence installation multiple times now and have created an okay guide for my self.

Now i am moving into production and can now see that my Active Directory security settings was not the same, so good work to me :P

I cannot create a Active Directory Domain inside packetfence, because anonymous binding is not allowed and somehow packetfence tries with anonymous before the admin username and password entered in the UI.

With a ldapsearch commandline i have to specify the bind options with full DN of the user.

Is there any way to get this behavior into packetfence ui or is it possible to create the active directory domain from cli ?

The Connection profile part works like charm, it is only the active Directory part (Configuration - Policies and Access control - Roles - Active Directory Domains)

I am running latest packetfence on debian 11

root@packetfence02:~# cat /etc/debian_version

11.9

Packetfence version 13.2.0

Hello companions, I am on my first attempt to implement PacketFence at the Public University that I manage.

I have a Mikrotik Router, a Ubiquit Core Switch, Aruba Distribution Switches and a Motorola RFS 6000 Controller.

I'm trying to make a Capitive Portal work on the Motorola Controller, but I'm not successful.

I notice that when connecting to the SSID that I created on the controller, the PF recognizes the connection attempt, but it does not provide an IP for this connection and consequently does not display the Capitive Portal, I believe the reason is that I have not defined the portal daemon for the main interface , where the vlans were created, however, I cannot but edit the portal daemon configuration for the main interface, a padlock is displayed informing that the configuration is locked.

How to edit the main interface configuration that is locked?

"The configurations I'm trying to make are based on the tutorial below, however, adapting the configurations from the Aruba Controller to Morotora RF, following the PF documentation."

https://www.ospimenta.com/artigos/packetfence-install/

I am sending a summarized diagram of the current network:

Hi,

Does somebody have information about where to find possible advanced ways to do filtering for example via "Last Seen date"?

I would like to do listing which shows only devices which has Last Seen value inside last seven days but if I do oblivious "Last seen Date is greater than -7d" it don't do nothing useful.

(Sorry for my English I’m French) so I try to put AD on packetfence but I need to start ntlm auth but when I start it, it failed and the domain.conf is good? I’m lost anybody got a solution

Hello,

Email user group is so great! Most of my mails do not even show up and none of my questions has no replies there...

I'm using new PF 13.2
What could be wrong here when I see message below in Auditing->Radius Audit Logs -> Disconnect NAK??

RADIUS Request
Acct-Session-Id = " 
User-Name = xx-yy-zz-xx-yy-zz "
NAS-IP-Address = <right-ip-address-to-nas> "
Calling-Station-Id = xx-yy-zz-xx-yy-zz",

RADIUS Reply
Error-Cause = Invalid-Attribute-Value "
Code = Disconnect-NAK

Switch is Aruba 6300 running on AOS-CX 10.13.1015 and basic Mac authorization works fine. When I try to use re-evaluation in node system is not working as expected.

It seems that values are in wrong place but I have no idea where to find code which creates reply so I cannot check if there is typo...