1

I have a SonicWall where I want to enable the RADIUS SSO capability. The article for doing this states the RADIUS server Send the user’s IP address in either Framed-IP-Address or Calling-Station-Id attribute in both Start and Stop messages.

My setup is as follows: AP -> NPS -> (RADIUS Accounting forwarded) Sonicwall

When connecting to the AP, it successfully logs in. When the forwarded event reaches the SonicWall, it does not have the Framed-IP-Address or the IP in the Calling-Station-Id (only MAC address).

 Attribute Value Pairs
    AVP: l=19  t=Acct-Session-Id(44): 53AB6162-00000010
    AVP: l=6  t=Acct-Status-Type(40): Stop(2)
    AVP: l=6  t=Acct-Authentic(45): RADIUS(1)
    AVP: l=10  t=User-Name(1): user
    AVP: l=6  t=NAS-IP-Address(4): 10.10.0.150
    AVP: l=14  t=NAS-Identifier(32): xxxxxxxxx
    AVP: l=6  t=NAS-Port(5): 0
    AVP: l=35  t=Called-Station-Id(30): XX-XX-XX-XX-XX-XX:SSID
    AVP: l=19  t=Calling-Station-Id(31): XX-XX-XX-XX-XX-XX
    AVP: l=6  t=NAS-Port-Type(61): Wireless-802.11(19)
    AVP: l=23  t=Connect-Info(77): CONNECT 0Mbps 802.11b
    AVP: l=46  t=Class(25): 420e04e70000013700011700000000000000000000000000...
    AVP: l=6  t=Acct-Session-Time(46): 604
    AVP: l=6  t=Acct-Input-Packets(47): 182
    AVP: l=6  t=Acct-Output-Packets(48): 145
    AVP: l=6  t=Acct-Input-Octets(42): 32797
    AVP: l=6  t=Acct-Output-Octets(43): 47272
    AVP: l=6  t=Event-Timestamp(55): Jun 26, 2014 09:47:54.000000000 PDT
    AVP: l=6  t=Acct-Terminate-Cause(49): User-Request(1)
    AVP: l=22  t=Proxy-State(33): 1700000000000000000000000000000000000039

I found out that my Ubiquiti APs do not send the Framed-IP-Address or the IP in the Calling-Station-Id and they recommend the RADIUS to get this information from the DHCP. I must be missing something as I cannot find the configuration anywhere in the NPS or the DHCP service.

How do I get the correct information to my SonicWall through DHCP or NPS?

2 Answers 2

2

Other people have asked Ubiquiti for the same thing to no avail. It looks, after examining the code, that it would take some reasonable engineering to make that happen. (Ubiquiti came to the same conclusion.)

The Ubiquiti APs are Linux-based and use hostapd to provide their AP functionality. I dug into the source for hostapd a little bit, and am not finding that it supports populating the Framed-IP-Address RADIUS attribute (src/radius/radius.c, the radius_attr_type radius_attrs struct). As far as populating the Calling-Station-Id attribute, hostpad only populates that with the MAC address, from what I can see (src/ap/ieee802_11_auth.c in the function hostapd_radius_acl_query where it gets the MAC from hostapd_allowed_address, and in src/ap/ieee802_1x.c in the function add_common_radius_sta_attr).

Since hostapd is concerned primarily with authenticating the mobile unit (MU) (and a little bit of RADIUS accounting) and isn't handling arbitrary IP traffic for the MU once it's authenticated it's not really going to have the IP of the MU to give to RADIUS.

I don't think you're going to get what you want w/o writing code. In theory, you could stick some kind of layer 7 RADIUS proxy between the NPS service and the Sonicwall and re-write that attribute from the MAC to the IP address (querying against your DHCP servers). FreeRADIUS policies might just be able to do what you want.

0

Following Evan's suggestion. I ended up writing my own code using the unifi-api by calmh. My fork of the project includes instructions on how to set it up with FreeRADIUS.

I went the FreeRADIUS > NPS (Auth) > Sonicwall (Acct) route.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .