Network Devices Configuration Guide

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License".

The fonts used in this guide are licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: http://scripts.sil.org/OFL

1. About this Guide

This guide covers the configuration of network devices in order to integrate them with PacketFence in VLAN enforcement. Switches, wireless controllers and wireless access points are all considered network devices in PacketFence’s terms.

The latest version of this guide is available at https://packetfence.org/documentation/

1.1. Other sources of information

Clustering Guide: Covers installation in a clustered environment.
Developer’s Guide: Covers API, captive portal customization, application code customizations and instructions for supporting new equipment.
Installation Guide: Covers installation and configuration of PacketFence.
Upgrade Guide: Covers compatibility related changes, manual instructions and general notes about upgrading.
PacketFence News: Covers noteworthy features, improvements and bug fixes by release.

These files are included in the package and release tarballs.

2. Note on Inline enforcement support

There is no need to follow the instructions in this guide if you plan on deploying in inline enforcement, except RADIUS inline. In this case all you need to do is to have a flat layer 2 network up to PacketFence’s inline interface with no other gateway available for devices to reach out to the Internet.

This technique is usually used when your network hardware does not support VLAN enforcement.

3. Note on RADIUS accounting

Enabling RADIUS accounting on your network devices will significantly increase the database size and may cause performance issues. You should be aware of this and only use RADIUS accounting if it is really needed.

4. List of supported Network Devices

PacketFence supports a whole lot of different wireless and wired network equipment from various vendors running different versions. Since we want to provide the most accurate information and avoid duplication of that same information, please refer to our website https://packetfence.org/about.html#/material

You’ll find on this page the enforcement modes supported by each and every single piece of equipment we tested and worked with.

5. Switch configuration

5.1. Assumptions

Throughout this configuration example we use the following assumptions for our network infrastructure:

PacketFence is fully configured with FreeRADIUS running (if you want 802.1X or MAC Auth)
PacketFence IP address: 192.168.1.5
Normal VLAN: 1
Registration VLAN: 2
Isolation VLAN: 3
MAC Detection VLAN: 4
Guest VLAN: 5
VoIP, Voice VLAN: 100
use SNMP v2c
SNMP Read community: public
SNMP Write community: private
SNMP Trap community: public
RADIUS Secret: useStrongerSecret

5.2. 3COM

5.2.1. SuperStack 3 Switch 4200 and 4500

PacketFence supports these 3Com switches without VoIP using one trap type:

linkUp===linkDown
Port Security (with static MACs)

Don’t forget to update the startup config!

linkUp === linkDown only

Global config settings:

snmp-agent
snmp-agent target-host trap address udp-domain 192.168.1.5 params securityname public
snmp-agent trap enable standard linkup linkdown

On each interface:

port access vlan 4

In Port Security

Global config settings:

snmp-agent
snmp-agent target-host trap address udp-domain 192.168.1.5 params securityname public
snmp-agent trap enable
port-security enable
port-security trap addresslearned
port-security trap intrusion

On each interface:

port access vlan 4
port-security max-mac-count 1
port-security port-mode secure
port-security intrusion-mode blockmac
undo enable snmp trap updown

In MAC Auth

Voice vlan : 6
Normal vlan : 1
Registration vlan : 2
Isolation vlan : 3

Global config settings:

lldp enable
lldp timer tx-interval 5
lldp compliance cdp
lldp compliance cdp

port-security enable
MAC-authentication domain packetfence

radius scheme system
radius scheme packetfence
 server-type extended
 primary authentication 192.168.1.5
 primary accounting 192.168.1.5
 key authentication P@cketfence
 key accounting cipher P@cketfence
 user-name-format without-domain

domain packetfence
 authentication radius-scheme packetfence
 accounting radius-scheme packetfence
 vlan-assignment-mode string
 accounting optional
domain system

voice vlan mac-address f4ea-6700-0000 mask ffff-ff00-0000 description Cisco IP Phone
undo voice vlan security enable
voice vlan 6 enable

On each interface with VoIP:

interface Ethernet1/0/1
 stp edged-port enable
 lldp compliance admin-status cdp txrx
 port link-type hybrid
 port hybrid vlan 6 tagged
 port hybrid vlan 1 2 3 untagged
 undo voice vlan mode auto
 voice vlan enable
 port-security max-mac-count 3
 port-security port-mode mac-authentication
 port-security intrusion-mode blockmac
 undo enable snmp trap updown

5.2.2. E4800G

PacketFence supports these 3Com switches with the following techniques:

802.1X with MAC Authentication fallback
linkUp/linkDown (not recommended)

Voice over IP support was not explicitly tested during implementation however it does not mean that it won’t work.

Don’t forget to update the startup config!

linkUp / linkDown only

Global config settings:

snmp-agent
snmp-agent target-host trap address udp-domain 192.168.1.5 params securityname public
snmp-agent trap enable standard linkup linkdown

On each interface:

port access vlan 4

802.1X with MAC Authentication fallback

Global config settings:

system-view
   radius scheme PacketFence
     primary authentication 192.168.1.5 1812
     primary accounting 192.168.1.5 1812
     key authentication useStrongerSecret
     user-name-format without-domain
     quit
   domain packetfence.local
     authentication default radius-scheme PacketFence
     authorization default radius-scheme PacketFence
     quit
   domain default enable packetfence.local
   dot1x authentication-method eap
   port-security enable
quit

If your management authentication on your switch is default, applying the configuration above will have your authentication switch to a RADIUS based one with PacketFence as the authentication server. It is almost certain that you do not want that!

Below, we will just create a local password for vty accesses (telnet) and nothing on the console. In order to avoid locking yourself out, make sure to verify your configuration!

system-view
   user-interface aux 0
     authentication-mode none
  user-interface vty 0 4
    user privilege level 3
    set authentication password simple useStrongerPassword
  quit
quit

On each interface:

system-view
  interface gigabitEthernet 1/0/xx
    port-security port-mode mac-else-userlogin-secure-ext
    # userlogin-secure-or-mac-ext could be used below instead
    # see the Switch_4200G's documentation for a discussion about it
    undo enable snmp trap updown
    quit
quit

where xx stands for the interface index.

5.2.3. E5500G and Switch 4200G

PacketFence supports these 3Com switches with the following techniques:

802.1X with MAC Authentication fallback
linkUp/linkDown (not recommended)

Voice over IP support was not explicitly tested during implementation however it does not mean that it won’t work.

Don’t forget to update the startup config !

linkUp / linkDown only

Global config settings:

snmp-agent
snmp-agent target-host trap address udp-domain 192.168.1.5 params
securityname public
snmp-agent trap enable standard linkup linkdown

On each interface:

port access vlan 4

802.1X with MAC Authentication fallback

Global config settings:

system-view
   radius scheme PacketFence
     server-type standard
     primary authentication 192.168.1.5 1812
     primary accounting 192.168.1.5 1812
     accounting optional
     key authentication useStrongerSecret
     user-name-format without-domain
     quit
   domain packetfence.local
     radius-scheme PacketFence
     vlan-assignment-mode string
     quit
   domain default enable packetfence.local
   dot1x authentication-method eap
   port-security enable
quit

Below, we will just create a local password for vty accesses (telnet) and nothing on the console. In order to avoid locking yourself out, make sure to verify your configuration!

system-view
   user-interface aux 0
     authentication-mode none
  user-interface vty 0 4
    user privilege level 3
    set authentication password simple useStrongerPassword
  quit
quit

On each interface:

system-view
  interface gigabitEthernet 1/0/xx
    port-security port-mode mac-else-userlogin-secure-ext
    # userlogin-secure-or-mac-ext could be used below instead
    # see the Switch_4200G's documentation for a discussion about it
    undo enable snmp trap updown
    quit
quit

where xx stands for the interface index

5.2.4. NJ220

This switch does not support port-security.

To configure: use web interface to send the linkUp/linkDown traps to the PacketFence server.

5.3. Alcatel

5.3.1. OS6250, OS6450

PacketFence supports this switch using 802.1X, Mac authentication and also supports VoIP.

Global configuration

First define any VLAN that you want to use on the switch.

vlan 2
vlan 5
vlan 20
vlan 100

Next, configure the RADIUS server to be PacketFence

aaa radius-server "packetfence" host 192.168.1.5 key useStrongerSecret
aaa authentication mac packetfence
aaa authentication 802.1X packetfence

You now need to configure a user profile (equivalent of a role) that will determine which VLAN is assigned to the device. In this case the profile names are 'unreg', 'employee' and 'guest'.

aaa user-network-profile name unreg vlan 2
aaa user-network-profile name guest vlan 5
aaa user-network-profile name employee vlan 20

Next, configure the switch in PacketFence. In the case of this example, the uplink is port 1/1.

[192.168.1.10]
mode=production
description=alcatel
type=Alcatel
radiusSecret=useStrongerSecret
uplink_dynamic=0
uplink=1001
RoleMap=Y
VlanMap=N
registrationRole=unreg
isolationRole=unreg
defaultRole=employee
guestRole=guest

802.1X

First, make sure you followed the steps above in 'Global configuration'

You will need to configure the ports you want to do authentication on.

vlan port mobile 1/2
vlan port 1/2 802.1X enable
802.1X 1/2 supplicant policy authentication pass group-mobility block fail block
802.1X 1/2 non-supplicant policy authentication pass group-mobility block fail block

MAC Authentication

First, make sure you followed the steps above in 'Global configuration' and '802.1X'

Next configure the interface to bypass 802.1X authentication

802.1X 1/2 supplicant bypass enable

VoIP

PacketFence supports VoIP on Alcatel by having multiple devices using multiple untagged VLANs on the same port.

First configure the user profile for voice. In this example it is only isolating it on another VLAN but any user profile attributes can be added to the profile.

aaa user-network-profile name voice vlan 3

Next, make sure you enable VoIP in the switch configuration in PacketFence and configure the voiceRole.

[192.168.1.10]
VoIPEnabled=Y
voiceRole=voice

5.3.2. OS6860

PacketFence supports this switch using 802.1X, Mac authentication and also supports VoIP.

This documentation is made for Alcatel OS 8.1+. Lower versions do not support this configuration.

Global configuration

First define any VLAN that you want to use on the switch.

vlan 2 admin-state enable
vlan 5 admin-state enable
vlan 20 admin-state enable
vlan 100 admin-state enable

Next, configure the RADIUS server to be PacketFence

aaa radius-server "packetfence" host 192.168.1.5 key useStrongerSecret
aaa device-authentication mac packetfence
aaa device-authentication 802.1X packetfence

You now need to configure an edge profile (equivalent of a role) that will determine which VLAN is assigned to the device. In this case the profile names are 'unreg', 'employee' and 'guest'.

unp edge-profile unreg
unp edge-profile unreg redirect enable
unp edge-profile unreg authentication-flag enable
unp vlan-mapping edge-profile unreg vlan 2

unp edge-profile guest
unp edge-profile guest redirect enable
unp edge-profile guest authentication-flag enable
unp vlan-mapping edge-profile guest vlan 5

unp edge-profile employee
unp edge-profile employee redirect enable
unp edge-profile employee authentication-flag enable
unp vlan-mapping edge-profile employee vlan 20

Make sure you enable the redirect on all your roles as the access reevaluation will not work without it.

Next, configure the switch in PacketFence. In the case of this example, the uplink is port 1/1/1.

[192.168.1.10]
mode=production
description=alcatel
type=Alcatel
radiusSecret=useStrongerSecret
uplink_dynamic=0
uplink=1001
RoleMap=Y
VlanMap=N
registrationRole=unreg
isolationRole=unreg
defaultRole=employee
guestRole=guest

MAC Authentication

First, make sure you followed the steps above in 'Global configuration'

You will need to create an edge template and apply it on the ports you want to do authentication on.

unp edge-template pf_mab
unp edge-template pf_mab mac-authentication enable
unp edge-template pf_mab classification enable
unp port 1/1/2 port-type edge
unp port 1/1/2 edge-template pf_mab

802.1X

First, make sure you followed the steps above in 'Global configuration'

You will need to create an edge template and apply it on the ports you want to do authentication on.

unp edge-template pf_dot1x
unp edge-template pf_dot1x 802.1X-authentication enable
unp edge-template pf_dot1x mac-authentication enable
unp edge-template pf_dot1x 802.1X-authentication failure-policy mac-authentication
unp port 1/1/2 port-type edge
unp port 1/1/2 edge-template pf_dot1x

VoIP

PacketFence supports VoIP on Alcatel by having multiple devices using multiple untagged VLANs on the same port.

First configure the edge profile for voice. In this example it is only isolating it on another VLAN but any edge profile attributes can be added to the profile.

unp edge-profile voice
unp edge-profile voice redirect enable
unp edge-profile voice authentication-flag enable
unp vlan-mapping edge-profile voice vlan 100

Next, make sure you enable VoIP in the switch configuration in PacketFence and configure the voiceRole.

[192.168.1.10]
VoIPEnabled=Y
voiceRole=voice

5.4. AlliedTelesis

5.4.1. AT8000GS

PacketFence supports the AT8000GS switch using :

MAC Authentication
802.1X
802.1X + VOIP

Assumptions

PacketFence management IP: 192.168.1.5
Switch management IP: 10.0.0.14
Guest VLAN (Internet): VLAN 1

MAC Authentication

First, enable 802.1X globally:

dot1x system-auth-control

Next, configure the RADIUS server and AAA settings:

radius-server host 192.168.1.5
radius-server key useStrongerSecret
radius-server source-ip 10.0.0.14
aaa authentication dot1x default radius
aaa accounting dot1x radius

In order to get mac authentication, you need to enable the guest VLAN globally:

interface vlan 1
name "Guest Vlan"
dot1x guest-vlan
exit

Finally, enable the necessary 802.1X settings for mac-only authentication:

interface ethernet g1
dot1x mac-authentication mac-only
dot1x radius-attributes vlan
dot1x port-control auto
dot1x guest-vlan enable

802.1X

The settings are almost the same as the MAC Authentication with some small differences.

First, enable 802.1X globally:

dot1x system-auth-control

Next, configure the RADIUS server and AAA settings:

radius-server host 192.168.1.5
radius-server key useStrongerSecret
radius-server source-ip 10.0.0.14
aaa authentication dot1x default radius
aaa accounting dot1x radius

Finally, enable the necessary 802.1X settings:

interface ethernet g1
dot1x radius-attributes vlan
dot1x port-control auto

802.1X + VOIP

First, enable 802.1X globally:

dot1x system-auth-control

Next, configure the RADIUS server configuration and AAA settings:

radius-server host 192.168.1.5
radius-server key useStrongerSecret
radius-server source-ip 10.0.0.14
aaa authentication dot1x default radius
aaa accounting dot1x radius

Then, LLDP configuration:

hostname switch-name
ip domain-name domain.local
lldp med network-policy 1 voice vlan 100 vlan-type tagged dscp 34
lldp med network-policy 2 voice-signaling vlan 100 vlan-type tagged dscp 34

Finally, enable the necessary 802.1X and VOIP settings on each interface:

interface ethernet g1
 dot1x port-control force-authorized
 no dot1x guest-vlan enable
 no dot1x mac-authentication
 no dot1x radius-attributes vlan
 no dot1x re-authentication
 switchport mode trunk
 switchport trunk native vlan 5
 switchport trunk allowed vlan add 100
 lldp med enable network-policy
 lldp med network-policy add 1
 lldp med network-policy add 2

802.1X commands

show dot1x supplicant brief

5.4.2. GS950

PacketFence supports the GS950 switch using :

MAC Authentication
802.1X (without fallback to MAC authentication)

Global configuration

First, ensure that the VLANs you want to assign are part of the VLAN database via the following page:

Note that they only need to be tagged on the trunk and don’t need any specific configuration for the dynamic VLAN assignment here.

Next, configure the RADIUS server (Security → RADIUS):

Next, configure an SNMP community (SNMP → Community Table)

MAC authentication

Go in Security → Port Access Control, select the port you want to enable MAB on, and ensure you set:

Authentication Mode: MAC Based
Port Control: Auto
Supplicant Mode: Single
VLAN Assignment: Enabled

802.1x

Go in Security → Port Access Control, select the port you want to enable MAB on, and ensure you set:

Authentication Mode: 802.1X
Port Control: Auto
Supplicant Mode: Multiple
VLAN Assignment: Enabled

PacketFence configuration

Ensure you configure at least:

Type: Allied Telesis GS950
RADIUS secret: useStrongerSecret
SNMP Version: v2c
SNMP Community Read: private
SNMP Community Write: private

If you are using MAC authentication on this switch, you must adjust the FreeRADIUS configuration so it transforms the EAP requests this switch sends into requests that PacketFence will interpret as MAC authentication. This configuration will also set missing attributes in the RADIUS requests since this switch doesn’t follow the standard attributes that are usually sent during RADIUS authentication.

To adjust it, go in /usr/local/pf/conf/radiusd/packetfence and add the following below the line that contains packetfence-eap-mac-policy:

packetfence-allied-gs950-mab

And then restart FreeRADIUS:

# /usr/local/pf/bin/pfcmd service radiusd restart

5.5. Amer

PacketFence supports Amer switches without VoIP using one trap type:

linkUp/linkDown

Don’t forget to update the startup config!

5.5.1. L2 Switch SS2R24i

Global config settings:

create snmp host 192.168.1.5 v2c public
create snmp user public ReadGroup
enable snmp traps

On each interface:

config vlan default delete xx
config vlan mac-detection add untagged xx

where xx stands for the interface index

5.6. Aruba

5.6.1. Aruba 2930M Serie

The Aruba 2930M is supported by PacketFence and it supports MAC Authentication, 802.1X, Dynamic ACLS and Web Authentication.

Global Radius Configuration

radius-server host 192.168.1.5 key "useStrongerSecret"
radius-server host 192.168.1.5 dyn-authorization
radius-server host 192.168.1.5 time-window 0
ip source-interface radius vlan 1
aaa server-group radius "PacketFence" host 10.5.6.100
aaa accounting network start-stop radius server-group "PacketFence"

MAC Authentication

aaa authentication mac-based chap-radius server-group "PacketFence"
aaa port-access mac-based 1
aaa port-access mac-based 1 addr-moves
aaa port-access mac-based 1 reauth-period 14400

802.1x

aaa authentication port-access eap-radius server-group "PacketFence"
aaa port-access authenticator 1
aaa port-access authenticator 1 tx-period 10
aaa port-access authenticator 1 client-limit 2
aaa port-access authenticator active

MAC Authentication Bypass

aaa authentication mac-based chap-radius server-group "PacketFence"
aaa authentication port-access eap-radius server-group "PacketFence"
aaa port-access 1 auth-order authenticator mac-based
aaa port-access mac-based 1
aaa port-access mac-based 1 addr-moves
aaa port-access mac-based 1 reauth-period 14400
aaa port-access authenticator 1
aaa port-access authenticator 1 tx-period 10
aaa port-access authenticator 1 client-limit 2
aaa port-access authenticator active

Web Authentication

aaa authentication captive-portal enable

On the PacketFence side you will need to fill the "Role by Access List" for the registration role:

permit in tcp from any to 192.168.1.5 80
permit in tcp from any to 192.168.1.5 443
deny in tcp from any to any 80 cpy
deny in tcp from any to any 443 cpy
permit in udp from any to any 53
permit in udp from any to any 67

And the "Role by Web Auth URL" for the registration role:

http://192.168.1.5/Aruba::2930M

Dynamic ACL

The switch needs to be configure to do MAC Authentication and or 802.1x. Then on the PacketFence side in the switch roles, enable "Role by Access List" and fill the appropriate role with the acl you want.

5.7. Avaya

Avaya bought Nortel’s wired networks assets. So Avaya switches are, in effect, re-branded Nortels. See Nortel section of this document for configuration instructions.

5.7.1. 802.1X with MAC Authentication Bypass and VoIP

The configuration below requires an ntp server. We use the PacketFence server as the NTP server but any other one will do. If you want to use the PacketFence server for NTP, make sure you install the appropriate service and open port 123 in /usr/local/pf/conf/iptables.conf

Global config settings:

sntp server primary address 192.168.1.5
sntp enable
radius server host 192.168.1.5 acct-enable
radius server host key useStrongerSecret
radius server host key useStrongerSecret used-by eapol
radius server host key useStrongerSecret used-by non-eapol
radius dynamic-server client 192.168.1.5
radius dynamic-server client 192.168.1.5 secret useStrongerSecret
radius dynamic-server client 192.168.1.5 enable
radius dynamic-server client 192.168.1.5 process-change-of-auth-requests
radius dynamic-server client 192.168.1.5 process-disconnect-requests

vlan create 2,3,4,5 type port
vlan create 100 type port voice-vlan
vlan name 2 "Reg"
vlan name 3 "Isol"
vlan name 4 "Detect"
vlan name 5 "Guest"
vlan name 100 "Voice"

#Uplink configuration
vlan ports 24 tagging tagAll
vlan configcontrol autopvid

eapol multihost allow-non-eap-enable
eapol multihost radius-non-eap-enable
eapol multihost non-eap-phone-enable
eapol multihost use-radius-assigned-vlan
eapol multihost non-eap-use-radius-assigned-vlan
eapol multihost eap-packet-mode unicast
eapol multihost non-eap-reauthentication-enable
eapol multihost adac-non-eap-enable
no eapol multihost non-eap-pwd-fmt ip-addr
no eapol multihost non-eap-pwd-fmt port-number
eapol multihost voip-vlan 1 enable vid 100

adac voice-vlan 100
adac uplink-port 24
adac op-mode tagged-frames
adac enable

qos if-group name TrustedLinks class trusted
qos if-assign port ALL name TrustedLinks

Port 1 configuration:

interface FastEthernet ALL
vlan ports 1 tagging tagAll
vlan members 2,3,4,5 1
vlan ports 1 pvid 2
eapol multihost port 1 enable eap-mac-max 8 allow-non-eap-enable non-eap-mac-max 8 radius-non-eap-enable use-radius-assigned-vlan non-eap-use-radius-assigned-vlan eap-packet-mode unicast adac-non-eap-enable
eapol port 1 status auto traffic-control in re-authentication enable
eapol port 1 radius-dynamic-server enable
lldp port 1 vendor-specific avaya dot1q-framing tagged
no adac detection port 1 mac
adac port 1 tagged-frames-tagging tag-all
adac port 1 enable
spanning-tree port 1 learning fast

5.8. Brocade

By default, all deconnections will be done using SNMP.

5.8.1. ICX 6400 Series

Those switches are supported using 802.1X for networks with or without VoIP.

Global config settings:

aaa authentication dot1x default radius
radius-server host 192.168.1.5 auth-port 1812 acct-port 1813 default
radius-server key useStrongerSecret

vlan 1 name DEFAULT-VLAN by port
!
vlan 100 by port
 tagged ethe 1/1/xx ethe 1/1/yy

Where xx and yy represent the range of ports where you want PacketFence enforcement.

MAC-Authentication without VoIP

Enable MAC-Authentication globally

mac-authentication enable
mac-authentication mac-vlan-dyn-activation

Enable MAC-Authentication on each interface you want PacketFence active
```
mac-authentication enable
mac-authentication enable-dynamic-vlan
```

MAC-Authentication with VoIP

Enable cdp globally
```
cdp run
```

Apply the following configuration on each interface you want PacketFence active

dual-mode
mac-authentication enable
mac-authentication enable-dynamic-vlan
voice-vlan 100
cdp enable

802.1X/MAC-Auth

Enable 802.1X globally

dot1x-enable
 re-authentication
 enable ethe 1/1/xx

Where xx is the switch port number

Apply the following configuration on each interface you want PacketFence active

dot1x port-control auto
dual-mode
mac-authentication enable
mac-authentication enable-dynamic-vlan
voice-vlan 100

5.8.2. Firmware 08.0.80 and above

802.1x/MAC-Auth

Those switches are supported using 802.1X for networks with or without VoIP.

RADIUS server configuration

radius-server host 192.168.1.5 auth-port 1812 acct-port 1813 default key useStrongerSecret dot1x mac-auth no-login

Authentication configuration

aaa authentication dot1x default radius
authentication
  auth-default-vlan 2
  re-authentication
  auth-fail-action restricted-vlan
  dot1x enable
  dot1x enable ethe 1/1/1
  dot1x port-control auto ethe 1/1/1
  dot1x macauth-override
  dot1x timeout tx-period 3
  dot1x timeout quiet-period 2
  mac-authentication enable
  mac-authentication enable ethe 1/1/1

The configuration above enables authentication on port 1/1/1 - make sure you change this to the ports where you want to perform enforcement.

SNMP configuration

snmpserver community public ro
snmpserver community private rw

PacketFence configuration

While configuring the switch in PacketFence, ensure you set at least the following values: * Definition, Type: Brocade Switches * RADIUS, Secret Passphrase: useStrongerSecret * SNMP, Version: v2c * SNMP, Community Read: public * SNMP, Community Write: private

VoIP

In order to enable VoIP, you first need to enable LLDP then define the network policy for tagging VoIP traffic on the ports where PacketFence is enabled.

lldp run
lldp med network-policy application voice tagged vlan 5 priority 5 dscp 46 ports ethe 1/1/1

Make sure you change VLAN 5 to the VLAN you use for VoIP

PacketFence configuration

While configuring the switch in PacketFence, ensure you set at least the following values: * Roles, voice VLAN: 5 * Definition, VoIP: enabled

5.8.3. Radius CLI Login

If you want to use the server PacketFence to authenticate users on the Brocade switch.

Configure the radius server to send user authentication request to PacketFence
```
aaa authentication login default radius local
```

Make sure to have a local account in case the switch can not reach the PacketFence server

5.9. Cisco

PacketFence supports Cisco switches with VoIP using three different trap types:

linkUp/linkDown
MAC Notification
Port Security (with static MACs)

You also need to make sure that lldp or cdp notification is configured on all ports that will handle VoIP.

On some recent models, we can also use more secure and robust features like:

MAC Authentication (Cisco’s MAC Authentication Bypass or MAB)
802.1X (Multi-Host or Multi-Domain)

Depending of the switch model, we recommend the use of the most secure and reliable feature first. In other words, you should consider the following order:

802.1X/MAB
Port-Security
linkUp/linkDown

5.9.1. 2900XL / 3500XL Series

SNMP | linkUP/linkDown

Global config settings:

snmp-server community public RO
snmp-server community private RW
snmp-server enable traps snmp linkdown linkup
snmp-server enable traps mac-notification
snmp-server host 192.168.1.5 trap version 2c public snmp mac-notification
mac-address-table notification interval 0
mac-address-table notification
mac-address-table aging-time 3600

On each interface without VoIP:

switchport mode access
switchport access vlan 4
snmp trap mac-notification added

On each interface with VoIP:

switchport trunk encapsulation dot1q
switchport trunk native vlan 4
switchport mode trunk
switchport voice vlan 100
snmp trap mac-notification added
snmp trap mac-notification removed

5.9.2. Cisco IOS

This switch module is built for switches using Cisco IOS versions earlier than 12.2(46)SE. This provides support for PortSecurity for networks with or without VoIP.

PortSecurity for IOS earlier than 12.2(46)SE

Global config settings:

snmp-server community public RO
snmp-server community private RW
snmp-server enable traps port-security
snmp-server enable traps port-security trap-rate 1
snmp-server host 192.168.1.5 version 2c public port-security

On each interface without VoIP:

switchport access vlan 4
switchport port-security
switchport port-security maximum 1 vlan access
switchport port-security violation restrict
switchport port-security mac-address 0200.000x.xxxx

where xxxxx stands for the interface ifIndex

On each interface with VoIP:

switchport voice vlan 100
switchport access vlan 4
switchport port-security
switchport port-security maximum 2
switchport port-security maximum 1 vlan access
switchport port-security violation restrict
switchport port-security mac-address 0200.000x.xxxx

where xxxxx stands for the interface ifIndex

Use the following templates for interface IfIndex in bogus MAC addresses (0200.000x.xxxx):

Fa0/1…Fa0/48 → 10001…10048
Gi0/1…Gi0/48 → 10101…10148

5.9.3. Cisco IOS 12.x

Those versions are now supported using 802.1X for networks with or without VoIP. You can also use port-security with static MAC address but we can not secure a MAC on the data VLAN specifically so enable it if there is no VoIP, use linkUp/linkDown and MAC notification otherwise.So on setup that needs to handle VoIP with this switch, go with a 802.1X configuration. Note: This module is renamed from the old 2950 module and therefore inherits all its capabilities.

802.1X

Make sure that you have a local account, because enabling 802.1X or MAB will ask for a username and password on the next login.

Global config settings:

dot1x system-auth-control

AAA configuration:

aaa new-model
aaa group server radius packetfence
 server 192.168.1.5 auth-port 1812 acct-port 1813
aaa authentication login default local
aaa authentication dot1x default group packetfence
aaa authorization network default group packetfence

AAA configuration (accounting):

aaa accounting dot1x default start-stop group packetfence

RADIUS server configuration:

radius-server host 192.168.1.5 auth-port 1812 acct-port 1813 timeout 2
key useStrongerSecret
radius-server vsa send authentication

On each interface without VoIP:

switchport access vlan 4
switchport mode access
dot1x port-control auto
dot1x host-mode multi-host
dot1x reauthentication

On each interface with VoIP:

switchport access vlan 4
switchport mode access
switchport voice vlan 100
dot1x port-control auto
dot1x host-mode multi-host
dot1x reauthentication

Port-Security

With port-security, if no MAC is connected on ports when activating port-security, we need to secure bogus MAC addresses on ports in order for the switch to send a trap when a new MAC appears on a port. On the other hand, if a MAC is actually connected when you enable port security, you must secure this MAC rather than the bogus one. Otherwise this MAC will lose its connectivity instantly.

Global config settings without VoIP:

snmp-server enable traps port-security
snmp-server enable traps port-security trap-rate 1
snmp-server host 192.168.1.5 version 2c public port-security

On each interface without VoIP:

switchport mode access
switchport access vlan 4
switchport port-security
switchport port-security violation restrict
switchport port-security mac-address 0200.0000.00xx

where xx stands for the interface ifIndex.

Use the following templates for interface IfIndex in bogus MAC addresses (0200.0000.00xx):

Fa0/1, …, Fa0/48 ⇒ 1, …, 48
Gi0/1, Gi0/2 ⇒ 49, 50

Global config settings with VoIP:

snmp-server community public RO
snmp-server community private RW
snmp-server enable traps snmp linkdown linkup
snmp-server enable traps mac-notification
snmp-server host 192.168.1.5 trap version 2c public snmp mac-notification
mac-address-table notification interval 0
mac-address-table notification
mac-address-table aging-time 3600

On each interface with VoIP:

switchport voice vlan 100
switchport access vlan 4
switchport mode access
snmp trap mac-notification added
snmp trap mac-notification removed

5.9.4. 3550 (802.1X with MAB)

The Catalyst 3550 does not support 802.1X with Multi-Domain, it can only support 802.1X with MAB using Multi-Host, MAB, and port security.

The Catalyst 3550 does not support CoA. Minimal IOS required for CoA is 12.2(52)SE. Latest available IOS for 3550 is 12.2(46)SE. Set "Deauthentication Method" to "SNMP" in PacketFence Administration GUI under Configuration → Policies and Access Control → Network Devices → Switches for the switch IP configured below.

Global settings:

dot1x system-auth-control
aaa new-model
aaa group server radius packetfence
 server 192.168.1.5 auth-port 1812 acct-port 1813
aaa authentication login default local
aaa authentication dot1x default group packetfence
aaa authorization network default group packetfence

RADIUS server configuration:

radius-server host 192.168.1.5 auth-port 1812 acct-port 1813 timeout 2 key useStrongerSecret
radius-server vsa send authentication

Enable SNMP on the switch:

snmp-server community public RO
snmp-server community private RW

On each interface:

switchport mode access
dot1x mac-auth-bypass
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout quiet-period 2
dot1x timeout reauth-period 7200
dot1x timeout tx-period 3
dot1x reauthentication

5.9.5. Cisco IOS 15.0

This switch module is built for switches using Cisco IOS versions 15.0 or greater. Note: This module is renamed from the old 2960 module and therefore inherits all its capabilities.

For 802.1X and MAB configurations, refer to this section below.

PortSecurity for IOS 12.2(46)SE or greater

Since version PacketFence 2.2.1, the way to handle VoIP when using port-security dramatically changed. Ensure that you follow the instructions below. To make the story short, instead on relying on the dynamic MAC learning for VoIP, we use a static entry on the voice VLAN so we can trigger a new security violation, and then authorize the phone MAC address on the network.

Global config settings:

snmp-server community public RO
snmp-server community private RW
snmp-server enable traps port-security
snmp-server enable traps port-security trap-rate 1
snmp-server host 192.168.1.5 version 2c public port-security

On each interface without VoIP:

switchport access vlan 4
switchport port-security
switchport port-security maximum 1 vlan access
switchport port-security violation restrict
switchport port-security mac-address 0200.000x.xxxx

where xxxxx stands for the interface ifIndex

On each interface with VoIP:

switchport voice vlan 100
switchport access vlan 4
switchport port-security
switchport port-security maximum 2
switchport port-security maximum 1 vlan access
switchport port-security maximum 1 vlan voice
switchport port-security violation restrict
switchport port-security mac-address 0200.010x.xxxx vlan voice
switchport port-security mac-address 0200.000x.xxxx vlan access

where xxxxx stands for the interface ifIndex

Use the following templates for interface IfIndex in bogus MAC addresses (0200.000x.xxxx):

Fa0/1…Fa0/48 → 10001…10048
Gi0/1…Gi0/48 → 10101…10148

2960, 2970, 3560, 3750

You shouldn’t use any port-security features when doing 802.1X and/or MAC Authentication. This can cause unexpected behavior.

Make sure that you have a local account, because enabling 802.1X or MAB will ask for a username and password on the next login.

When doing 802.1X and network interface teaming on the same switch or stack, you might consider using the mac-move feature of the Cisco switches. When you authenticate the primary link of the team, the virtual MAC address will be published and authorized on the switchport. When something breaks on that link (ie. cable disconnected), the teaming driver will publish the MAC address on the secondary link, and the switch will try to authorize it. However, since the switch already has the MAC address in a session on another switchport, the switch will put the secondary link into err-disabled mode.

To prevent this behavior, you need to tell the switch to allow MAC address movements between ports. The global command is the following:

authentication mac-move permit

Global settings:

dot1x system-auth-control
aaa new-model
aaa group server radius packetfence
 server name pfnac
aaa authentication login default local
aaa authentication dot1x default group packetfence
aaa authorization network default group packetfence

RADIUS server configuration:

radius server pfnac
  address ipv4 192.168.1.5 auth-port 1812 acct-port 1813
  automate-tester username dummy ignore-acct-port idle-time 3
  key 0 useStrongerSecret

radius-server vsa send authentication

CoA configuration

aaa server radius dynamic-author
 client 192.168.1.5 server-key useStrongerSecret
 port 3799

Activate SNMP v1 on the switch:

snmp-server community public RO

802.1X with MAC Authentication bypass (MultiDomain)

On each interface:

switchport mode access
switchport voice vlan 100
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer restart 10800
authentication timer reauthenticate 10800
authentication violation replace
mab
no snmp trap link-status
dot1x pae authenticator
dot1x timeout quiet-period 2
dot1x timeout tx-period 3

802.1X with MAC Authentication bypass (MultiHost)

On each interface:

switchport mode access
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer restart 10800
authentication timer reauthenticate 7200
authentication violation replace
mab
no snmp trap link-status
dot1x pae authenticator
dot1x timeout quiet-period 2
dot1x timeout tx-period 3

MAC Authentication bypass only

On each interface:

switchport mode access
switchport voice vlan 100
dot1x mac-auth-bypass
dot1x pae authenticator
dot1x port-control auto
dot1x timeout tx-period 5
dot1x reauthentication
authentication periodic
authentication timer restart 10800
authentication timer reauthenticate 7200
authentication violation replace
mab
no snmp trap link-status

There’s a lot of different versions of the Catalyst 2960. Some of them may not accept the command stated in this guide for 802.1X.

We have found a couple of commands that are working great or MAB:

On each interface

switchport mode access
authentication order mab
authentication port-control auto
mab
dot1x pae authenticator

But, as it is difficult for us to maintain the whole list of commands to configure each and every different model of 2960 with different IOS, please refer to Cisco documentation for very specific cases.

Web auth

The Catalyst 2960 supports web authentication from IOS 12.2.55SE3. This procedure has been tested on IOS 15.0.2SE5.

In this example, the ACL that triggers the redirection to the portal for registration is 'registration'.

Configure the global configuration of the switch using the section MAC Authentication bypass only of Cisco IOS 15.0 in this document.

Then add this additional configuration on the global level

ip device tracking
ip http server
ip http secure-server
snmp-server community public RO
snmp-server community private RW

Add the required access lists

ip access-list extended registration
 deny ip any host <your captive portal ip>
 permit tcp any any eq www
 permit tcp any any eq 443

Then on each controlled interface

switchport access vlan <vlan>
switchport mode access
authentication priority mab
authentication port-control auto
authentication periodic
authentication violation replace
mab
spanning-tree portfast

PacketFence switch configuration

Select the type to 'Cisco IOS 15.0'
Set the 'Registration' role to 'registration' (If left empty then it will use the role name)
Set Role by Web Auth URL for registration to 'http://<your_captive_portal_ip>/Cisco::Cisco_IOS_15_0'
The URL can contain dynamic parameters, like the MAC address ($mac), the switch IP ($switch_ip), the username ($user_name).
Screenshots of this configuration are available in the Cisco WLC section of this guide.

Dynamic ACLs

The Cisco IOS 15.5 supports RADIUS pushed ACLs which means that you can define the ACLs centrally in PacketFence without configuring them in your switches and their rules will be applied to the switch during the authentication.

These ACLs are defined by role like the VLANs which means you can define different ACLs for your registration VLAN, production VLAN, guest VLAN, etc.

Add the following configuration setting on the global level

ip device tracking

For IOS 12.2, you need to create this acl and assign it to the switch port interface:

ip access-list extended Auth-Default-ACL
 permit udp any range bootps 65347 any range bootpc 65348
 permit udp any any range bootps 65347
 permit udp any any eq domain
 deny   ip any any

interface GigabitEthernetx/y/z
 ...
 ip access-group Auth-Default-ACL in
 ...

Before continuing, configure your switch to be in MAC authentication bypass or 802.1X.

Now in the PacketFence interface go in the switch configuration and in the Roles tab.

Check 'Role by access list' and you should now be able to configure the access lists as below.

For example if you want the users that are in the registration VLAN to only use HTTP, HTTPS, DNS and DHCP you can configure this ACL in the registration category.

Now if for example, your normal users are placed in the 'default' category and your guests in the 'guest' category.

If for example the 'default' category uses the network 192.168.5.0/24 and your guest network uses the network 192.168.10.0/24.

You can prevent communications between both networks using these access lists

You could also only prevent your guest users from using shared directories

Or also you could restrict your users to use only your DNS server where 192.168.5.2 is your DNS server

5.9.6. Cisco IOS 15.5

For 802.1X and MAB configurations, refer to this section below.

PortSecurity for IOS 12.2(46)SE or greater

Global config settings:

snmp-server community public RO
snmp-server community private RW
snmp-server enable traps port-security
snmp-server enable traps port-security trap-rate 1
snmp-server host 192.168.1.5 version 2c public port-security

On each interface without VoIP:

switchport access vlan 4
switchport port-security
switchport port-security maximum 1 vlan access
switchport port-security violation restrict
switchport port-security mac-address 0200.000x.xxxx

where xxxxx stands for the interface ifIndex

On each interface with VoIP:

switchport voice vlan 100
switchport access vlan 4
switchport port-security
switchport port-security maximum 2
switchport port-security maximum 1 vlan access
switchport port-security maximum 1 vlan voice
switchport port-security violation restrict
switchport port-security mac-address 0200.010x.xxxx vlan voice
switchport port-security mac-address 0200.000x.xxxx vlan access

where xxxxx stands for the interface ifIndex

Use the following templates for interface IfIndex in bogus MAC addresses (0200.000x.xxxx):

Fa0/1…Fa0/48 → 10001…10048
Gi0/1…Gi0/48 → 10101…10148

2960, 2970, 3560, 3750

You shouldn’t use any port-security features when doing 802.1X and/or MAC Authentication. This can cause unexpected behavior.

Make sure that you have a local account, because enabling 802.1X or MAB will ask for a username and password on the next login.

To prevent this behavior, you need to tell the switch to allow MAC address movements between ports. The global command is the following:

authentication mac-move permit

Global settings:

dot1x system-auth-control
aaa new-model
aaa group server radius packetfence
 server name pfnac
aaa authentication login default local
aaa authentication dot1x default group packetfence
aaa authorization network default group packetfence

RADIUS server configuration:

radius server pfnac
  address ipv4 192.168.1.5 auth-port 1812 acct-port 1813
  automate-tester username dummy ignore-acct-port idle-time 3
  key 0 useStrongerSecret

radius-server vsa send authentication

CoA configuration

aaa server radius dynamic-author
 client 192.168.1.5 server-key useStrongerSecret
 port 3799

Activate SNMP v1 on the switch:

snmp-server community public RO

802.1X with MAC Authentication bypass (MultiDomain)

On each interface:

switchport mode access
switchport voice vlan 100
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer restart 10800
authentication timer reauthenticate 10800
authentication violation replace
mab
no snmp trap link-status
dot1x pae authenticator
dot1x timeout quiet-period 2
dot1x timeout tx-period 3

802.1X with MAC Authentication bypass (MultiHost)

On each interface:

switchport mode access
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer restart 10800
authentication timer reauthenticate 7200
authentication violation replace
mab
no snmp trap link-status
dot1x pae authenticator
dot1x timeout quiet-period 2
dot1x timeout tx-period 3

MAC Authentication bypass only

On each interface:

switchport mode access
switchport voice vlan 100
dot1x mac-auth-bypass
dot1x pae authenticator
dot1x port-control auto
dot1x timeout tx-period 5
dot1x reauthentication
authentication periodic
authentication timer restart 10800
authentication timer reauthenticate 7200
authentication violation replace
mab
no snmp trap link-status

There’s a lot of different versions of the Catalyst 2960. Some of them may not accept the command stated in this guide for 802.1X.

We have found a couple of commands that are working great or MAB:

On each interface

switchport mode access
authentication order mab
authentication port-control auto
mab
dot1x pae authenticator

Web auth

The Catalyst 2960 supports web authentication from IOS 12.2.55SE3. This procedure has been tested on IOS 15.0.2SE5.

In this example, the ACL that triggers the redirection to the portal for registration is 'registration'.

Configure the global configuration of the switch using the section MAC Authentication bypass only of Cisco IOS 15.5 in this document.

Then add this additional configuration on the global level

ip device tracking
ip http server
ip http secure-server
snmp-server community public RO
snmp-server community private RW

Add the required access lists

ip access-list extended registration
 deny ip any host <your captive portal ip>
 permit tcp any any eq www
 permit tcp any any eq 443

Then on each controlled interface

switchport access vlan <vlan>
switchport mode access
authentication priority mab
authentication port-control auto
authentication periodic
authentication violation replace
mab
spanning-tree portfast

PacketFence switch configuration

Select the type to 'Cisco IOS 15.5'
Set the 'Registration' role to 'registration' (If left empty then it will use the role name)
Set Role by Web Auth URL for registration to 'http://<your_captive_portal_ip>/Cisco::Cisco_IOS_15_5'
The URL can contain dynamic parameters, like the MAC address ($mac), the switch IP ($switch_ip), the username ($user_name).
Screenshots of this configuration are available in the Cisco WLC section of this guide.

Dynamic ACLs

These ACLs are defined by role like the VLANs which means you can define different ACLs for your registration VLAN, production VLAN, guest VLAN, etc.

Add the following configuration setting on the global level

ip device tracking

For IOS 12.2, you need to create this acl and assign it to the switch port interface:

ip access-list extended Auth-Default-ACL
 permit udp any range bootps 65347 any range bootpc 65348
 permit udp any any range bootps 65347
 permit udp any any eq domain
 deny   ip any any

interface GigabitEthernetx/y/z
 ...
 ip access-group Auth-Default-ACL in
 ...