• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

FreeRADIUS MAC authentication

pfSense Packages
4
15
7.0k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • K
    keyser Rebel Alliance @aaronssh
    last edited by Jul 19, 2023, 9:12 PM

    @aaronssh Freeradius (and most other Radius’) are setup to use PAP and CHAP Authentication by default when attempting MAC Auth.
    The log entry also seems to suggest that Freeradius cannot complete the auth attempts because of its missing EAP setup - which is understandable if your switch is using EAP.

    Try using PAP as the protocol on your switch, or otherwise you need to setup your Freeradius with the EAP settings needed to communicate with your switch.

    Love the no fuss of using the official appliances :-)

    A 1 Reply Last reply Jul 24, 2023, 2:32 PM Reply Quote 0
    • A
      aaronssh @keyser
      last edited by aaronssh Jul 24, 2023, 2:33 PM Jul 24, 2023, 2:32 PM

      @keyser So I tried switching to PAP but am getting the same errors. I have a question though, I am testing this on my Macbook and each time I connect it prompts for 802.1x credentials rather than using the MAC address. I have a hunch that is why we are seeing in FreeRADIUS:

      Login incorrect (Failed retrieving values required to evaluate condition): [00-E0-97-00-35-4B] (from client Omada port 1 cli 00-E0-97-00-35-4B)
      

      Because when this box comes up, I hit cancel:
      πŸ”’ Log in to view

      Is there some trick to forcing the MAC address auth and bypassing this 802.1x screen? At this point I can't tell if that is a MacOS quirk, a quirk with my switch, or something with FreeRADIUS.

      N 1 Reply Last reply Jul 24, 2023, 2:56 PM Reply Quote 0
      • N
        NogBadTheBad @aaronssh
        last edited by Jul 24, 2023, 2:56 PM

        @aaronssh Try running radsniff -x from a ssh session on your pfSense box

        A G 2 Replies Last reply Jul 24, 2023, 3:03 PM Reply Quote 0
        • A
          aaronssh @NogBadTheBad
          last edited by Jul 24, 2023, 3:03 PM

          @NogBadTheBad

          πŸ”’ Log in to view

          A 1 Reply Last reply Jul 24, 2023, 3:17 PM Reply Quote 0
          • A
            aaronssh @aaronssh
            last edited by Jul 24, 2023, 3:17 PM

            @aaronssh I am not sure how to read that output in the screenshot above other than it looks like FreeRADIUS is rejecting the auth attempt. I don't understand why.

            1 Reply Last reply Reply Quote 0
            • G
              Gertjan @NogBadTheBad
              last edited by Jul 24, 2023, 3:30 PM

              @NogBadTheBad

              radsniff is nice.

              I'll add another one :
              Shut down FreeRadius in the pfSense GUI.

              On the pfSense command line (SSH - NOT GUI !!) or console : menu 8 :

              radiusd -X
              

              Enjoy.

              Totally useless, but I say it anyway : if you think FreeRadius doesn't show something, then this means it didn't receive something.
              Also, terminology used is rather cryptic. Radius is .... well .... Radius.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              A 1 Reply Last reply Jul 24, 2023, 3:37 PM Reply Quote 0
              • A
                aaronssh @Gertjan
                last edited by Jul 24, 2023, 3:37 PM

                @Gertjan said in FreeRADIUS MAC authentication:

                radiusd -X

                I do get a lot more info that way, but I don't know how to interpret what I'm seeing here. Can you determine what this means?

                πŸ”’ Log in to view

                πŸ”’ Log in to view

                G 1 Reply Last reply Jul 24, 2023, 3:49 PM Reply Quote 0
                • G
                  Gertjan @aaronssh
                  last edited by Jul 24, 2023, 3:49 PM

                  @aaronssh

                  Welll ... I never used pfSense Freeradius to do MAC authentication / identification.

                  I do see the same :
                  πŸ”’ Log in to view - consider this one harmless.

                  I don't know who is 10.173.7.104 neither 10.173.7.1 (probably : pfSense but it has a strange LAN IP)
                  00-e0-97-00-35-4b looks like a MAC. From what device ?
                  Etc.

                  I'm the more basic "user + password" guy.

                  The pfSense documentation hasn't a doc / example for you ?

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  A 1 Reply Last reply Jul 24, 2023, 3:58 PM Reply Quote 0
                  • A
                    aaronssh @Gertjan
                    last edited by Jul 24, 2023, 3:58 PM

                    @Gertjan
                    10.173.7.104 is the switch
                    10.173.7.1 is pfSense
                    00-e0-97-00-35-4b is the MAC address on my Macbook

                    So all of that looks right to me, and I don't understand why it is rejecting.

                    K 1 Reply Last reply Jul 24, 2023, 4:30 PM Reply Quote 0
                    • K
                      keyser Rebel Alliance @aaronssh
                      last edited by Jul 24, 2023, 4:30 PM

                      @aaronssh Perhaps you forgot to enable MAC bypass in Freeradius since your client is 802.1x challenged?

                      πŸ”’ Log in to view

                      Love the no fuss of using the official appliances :-)

                      A 1 Reply Last reply Jul 24, 2023, 4:35 PM Reply Quote 0
                      • A
                        aaronssh @keyser
                        last edited by Jul 24, 2023, 4:35 PM

                        @keyser I noticed that and tried it both ways, but it does not change the result or the error messages.

                        A 1 Reply Last reply Jul 24, 2023, 4:50 PM Reply Quote 0
                        • A
                          aaronssh @aaronssh
                          last edited by aaronssh Jul 24, 2023, 4:51 PM Jul 24, 2023, 4:50 PM

                          So I noticed in the logs that both the USER and PASS that are being passed to FreeRADIUS are the MAC address. I have that MAC address entered in the MACs section of FreeRADIUS so to me it seems like it SHOULD at that point authenticate ok. It obviously doesn't.

                          So I thought, what the hell, let's trying setting up a user under USERS in FreeRADIUS and enter the MAC address as both the user and pass. Bam, that works! So seems very counterintuitive but that's good enough for me. Thank you everyone for your help!

                          K N 2 Replies Last reply Jul 24, 2023, 6:22 PM Reply Quote 0
                          • K
                            keyser Rebel Alliance @aaronssh
                            last edited by Jul 24, 2023, 6:22 PM

                            @aaronssh Well, I’m using mac-auth and my clients are entered on the MAC addresses sheet, so it does work in the right configuration.
                            But if you are not going to use 802.1x you can just create the MAc addresses as users.

                            Love the no fuss of using the official appliances :-)

                            1 Reply Last reply Reply Quote 0
                            • N
                              NogBadTheBad @aaronssh
                              last edited by Jul 24, 2023, 6:29 PM

                              This post is deleted!
                              1 Reply Last reply Reply Quote 0
                              11 out of 15
                              • First post
                                11/15
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.