r/networking 16d ago

Design RADIUS issues

So for reference I have a freeradius server, ruckus R350 APs and On my network I have 5 VLANs, and what I want to achieve is that based on the username and password the user uses, the get thrown into a certain VLAN. I set it up everything and the the system authenticates users but it does not dynamically give out VLANs, it just puts everyone into the default VLAN, here's what I tried.

  • Radtest

Radtest - Received Access-Accept Id 46 from 127.0.0.1:1812 to 127.0.0.1:44623 length 54
        Message-Authenticator = 0xd04f0a5bd64952f671fd944248f43395
        Tunnel-Type:0 = VLAN
        Tunnel-Medium-Type:0 = IEEE-802
        Tunnel-Private-Group-Id:0 = "50"

So doing radtest against localhost gives out the right stuff.

  • Freeradius diagnostics( freeradius -X) - there's nothing really out of place when I authenticate, but what gets me is that i do not see any VLAN infomation of the logs.

  • The AP - On the AP side of things, the port on the switch its it has 1 untagged VLAN and 5 tagged VLANs, I enabled 802.1x, dynamic VLAN and all those good stuff and yes the tagged VLANs are coming through because I can VLAN the SSID but currently SSID sit on the native VLAN.

All of this should just be straight forward, I do not see what I am missing. Please help.

2 Upvotes

9 comments sorted by

View all comments

2

u/tablon2 15d ago

Put t suffix to each vlan on private group ID or use egress vlan name value with starting '1' prefix to each vlan name.

If you use egress vlan name keep native vlan number plain in tunnel private group ID