FreeRadius - Mac addresses treated as Users

markds

Hi,

I am using the FreeRadius package to provide authentication for WPA2 Enterprise SSID and also on a WPA2 Personal SSID to dynamically assign vlans based on mac addresses. The WPA2 Personal SSID is to provide connectivity for devices that do not support WPA2 Enterprise (with a reduced access).

However, I notice when logging into the WPA2 Enterprise SSID, I can authenticate using valid mac address as the username and password, which obviously is a major security concern.

Is there a way to limit the inclusion of a file (ie users / macs) based on the NAS connection? The thought was to configure the APs (UniFi) to use different Radius NAS credentials for the different use cases and hopefully avoid the problem.

Many thanks.

NogBadTheBad

@markds There is an option for a check item but the NAS identifier will be the same won't it ?

I use the following that only allows andy-iphone to connect via IPsec VPN.

"andy-iphone" Cleartext-Password := "xxxxxxx", Simultaneous-Use := "1", Expiration := "Apr 11 2027", NAS-Identifier == strongSwan 

	Framed-IP-Address = 172.16.8.1,
	Framed-IP-Netmask = 255.255.255.0,
	Framed-Route = "0.0.0.0/0 172.16.8.1 1"

Have a play and run radsniff -x from the console.

markds

Thats perfect... Will give it a try tonight. Thanks @NogBadTheBad