WLAN: VLAN-Zuordnung anhand Radius-Eigenschaften? MikroTik CAPsMAN

When CAP connects, CAPsMAN at first tries to bind each CAP radio to CAPsMAN master interface based on radio-mac. If an appropriate interface is found, radio gets set up using master interface configuration and configuration of slave interfaces that refer to particular master interface. At this moment interfaces (both master and slaves) are considered bound to radio and radio is considered provisioned.

If no matching master interface for radio is found, CAPsMAN executes 'provisioning rules'. Provisioning rules is an ordered list of rules that contain settings that specify which radio to match and settings that specify what action to take if a radio matches.  

Tunnel-Type =6
Tunnel-Medium-Type = 13
Tunnel-Private Group-Is = <VLANID>

(18) Received Access-Request Id 30 from 10.99.1.142:59601 to 192.168.7.166:1812 length 198
(18)   Service-Type = Framed-User
(18)   Framed-MTU = 1400
(18)   User-Name = "gast"
(18)   State = 0xad812f9ba59236162c49ea69e0cd2bdf
(18)   NAS-Port-Id = "wlan1"
(18)   NAS-Port-Type = Wireless-802.11
(18)   Calling-Station-Id = "00-23-FA-7B-D8-A6"
(18)   Called-Station-Id = "B8-69-F4-2E-20-C9:MikroTik"
(18)   EAP-Message = 0x0213002e190017030300230000000000000004a4bcaf9a4cccabf655455a93d1912f2fda1405f5cbe28f990a74e4
(18)   Message-Authenticator = 0x6aa4ac407ac22066ec3da55a07e59136
(18)   NAS-Identifier = "MikroTik"
(18)   NAS-IP-Address = 10.99.1.142
(18) session-state: No cached attributes
(18) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
(18)   authorize {
(18)     policy filter_username {
(18)       if (&User-Name) {
...
(18)       } # if (&User-Name)  = notfound
(18)     } # policy filter_username = notfound
(18)     [preprocess] = ok
(18)     [chap] = noop
(18)     [mschap] = noop
(18)     [digest] = noop
(18) suffix: Checking for suffix after "@"
(18) suffix: No '@' in User-Name = "gast", looking up realm NULL
(18) suffix: No such realm "NULL"
(18)     [suffix] = noop
(18) eap: Peer sent EAP Response (code 2) ID 19 length 46
(18) eap: Continuing tunnel setup
(18)     [eap] = ok
(18)   } # authorize = ok
(18) Found Auth-Type = eap
(18) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(18)   authenticate {
(18) eap: Expiring EAP session with state 0xad812f9ba5923616
(18) eap: Finished EAP session with state 0xad812f9ba5923616
(18) eap: Previous EAP request found for state 0xad812f9ba5923616, released from the list
(18) eap: Peer sent packet with method EAP PEAP (25)
(18) eap: Calling submodule eap_peap to process data
(18) eap_peap: Continuing EAP-TLS
(18) eap_peap: [eaptls verify] = ok
(18) eap_peap: Done initial handshake
(18) eap_peap: [eaptls process] = ok
(18) eap_peap: Session established.  Decoding tunneled attributes
(18) eap_peap: PEAP state send tlv success
(18) eap_peap: Received EAP-TLV response
(18) eap_peap: Success
(18) eap: Sending EAP Success (code 3) ID 19 length 4
(18) eap: Freeing handler
(18)     [eap] = ok
(18)   } # authenticate = ok
...
(18) Sent Access-Accept Id 30 from 192.168.7.166:1812 to 10.99.1.142:59601 length 0
(18)   MS-MPPE-Recv-Key = 0x6516c331440341c0919b036506162ecc073bbe23f7a819952be1360adddc5c49
(18)   MS-MPPE-Send-Key = 0xc8b85060633f915798fea009d424d35a7f7b9158771884b0d35eca26a45908c7
(18)   EAP-Message = 0x03130004
(18)   Message-Authenticator = 0x00000000000000000000000000000000
(18)   User-Name = "gast"
(18) Finished request
Waking up in 2.3 seconds.
(18) Cleaning up request packet ID 30 with timestamp +56
Ready to process requests 

(15)     [sql] = ok
(15)     [exec] = noop
(15)     policy remove_reply_message_if_eap {
(15)       if (&reply:EAP-Message && &reply:Reply-Message) {
(15)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(15)       else {
(15)         [noop] = noop
(15)       } # else = noop
(15)     } # policy remove_reply_message_if_eap = noop
(15)   } # post-auth = ok
(15) Sent Access-Accept Id 1 from 172.16.50.100:1812 to 172.16.10.20:63649 length 0
(15)   Tunnel-Type = VLAN
(15)   Tunnel-Medium-Type = IEEE-802
(15)   Mikrotik-Wireless-VLANID = 60
(15) Finished request

 eap: Peer sent EAP Response (code 2) ID 6 length 22
(6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize  
(6)       [eap] = ok
(6)     } # authorize = ok
(6)   Found Auth-Type = eap
(6)   # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel
(6)     authenticate {
(6) eap: Peer sent packet with method EAP Identity (1)
(6) eap: Calling submodule eap_mschapv2 to process data
(6) eap_mschapv2: Issuing Challenge
(6) eap: Sending EAP Request (code 1) ID 7 length 43
(6) eap: EAP session adding &reply:State = 0xfa92f4f8fa95eecd
(6)       [eap] = handled
(6)     } # authenticate = handled
(6) } # server inner-tunnel
(6) Virtual server sending reply
(6)   EAP-Message = 0x0107002b1a0107002610c43d0f3c8c8d5be2491184f1ce83f6c0667265657261646975732d332e302e3137
(6)   Message-Authenticator = 0x00000000000000000000000000000000
(6)   State = 0xfa92f4f8fa95eecd371b44a00e0c5c30
(6) eap_peap: Got tunneled reply code 11
(6) eap_peap:   EAP-Message = 0x0107002b1a0107002610c43d0f3c8c8d5be2491184f1ce83f6c0667265657261646975732d332e302e3137
(6) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(6) eap_peap:   State = 0xfa92f4f8fa95eecd371b44a00e0c5c30
(6) eap_peap: Got tunneled reply RADIUS code 11
(6) eap_peap:   EAP-Message = 0x0107002b1a0107002610c43d0f3c8c8d5be2491184f1ce83f6c0667265657261646975732d332e302e3137
(6) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(6) eap_peap:   State = 0xfa92f4f8fa95eecd371b44a00e0c5c30
(6) eap_peap: Got tunneled Access-Challenge
(6) eap: Sending EAP Request (code 1) ID 7 length 74
(6) eap: EAP session adding &reply:State = 0x6ee8e7dd68effed9
(6)     [eap] = handled
(6)   } # authenticate = handled
(6) Using Post-Auth-Type Challenge
(6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(6)   Challenge { ... } # empty sub-section is ignored
(6) Sent Access-Challenge Id 167 from 172.16.50.100:1812 to 172.16.50.1:33106 length 0
(6)   EAP-Message = 0x0107004a1900170303003ff86d6ad35ffdce038ec3963d4e914fee021b07127e8027e411e5b3232856161a04c1dc344b1a6861f1db3892475752c8b09965e83c26f77eca1dd362b8a157
(6)   Message-Authenticator = 0x00000000000000000000000000000000
(6)   State = 0x6ee8e7dd68effed9b891e94124c52626
(6) Finished request

# MikroTik Attributes
VENDOR          Mikrotik        14988
BEGIN-VENDOR    Mikrotik
ATTRIBUTE Mikrotik-Wireless-VLANID 26 integer
ATTRIBUTE Mikrotik-Wireless-VLANIDtype 27 integer
END-VENDOR      Mikrotik

Tunnel-Type 13
Tunnel-Medium-Type 6
Mikrotik-Wireless-VLANID 60

rlm_sql (sql): Released connection (23)
(67)     [sql] = ok
(67)     [exec] = noop
(67)     policy remove_reply_message_if_eap {
(67)       if (&reply:EAP-Message && &reply:Reply-Message) {
(67)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(67)       else {
(67)         [noop] = noop
(67)       } # else = noop
(67)     } # policy remove_reply_message_if_eap = noop
(67)   } # post-auth = ok
(67) Sent Access-Accept Id 253 from 172.16.50.100:1812 to 172.16.50.1:41593 length 0
(67)   Tunnel-Type = VLAN
(67)   Tunnel-Medium-Type = IEEE-802
(67)   Mikrotik-Wireless-VLANID = 60

0022:FA7B:D8A7  Cleartext-Password := "0022:FA7B:D8A7"
                        Tunnel-Type = VLAN,
                        Tunnel-Medium-Type = IEEE-802,
                        Mikrotik-Wireless-VLANID := 10,
                        Mikrotik-Wireless-Comment = "User1",
                        Mikrotik-Wireless-Forward := 1,
                        Mikrotik-Wireless-VLANID-type := 0 

(4)   Service-Type = Framed-User
(4)   NAS-Port-Id = "wlan1"
(4)   NAS-Port-Type = Wireless-802.11
(4)   User-Name = "0022:FA7B:D8A7"
(4)   Calling-Station-Id = "00-22-FA-7B-D8-A7"
(4)   Called-Station-Id = "B8-69-F4-2E-20-C9"
(4)   User-Password = "0022:FA7B:D8A7"
(4)   NAS-Identifier = "cAP-1"
(4)   NAS-IP-Address = 192.168.88.146
(4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
...
(4) files: users: Matched entry 0022:FA7B:D8A7 at line 79
(4) Found Auth-Type = PAP
(4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(4)   Auth-Type PAP {
(4) pap: Login attempt with password
(4) pap: Comparing with "known good" Cleartext-Password
(4) pap: User authenticated successfully
(4)     [pap] = ok
(4)   } # Auth-Type PAP = ok
(4) Sent Access-Accept Id 48 from 192.168.7.166:1812 to 10.1.1.149:59842 length 0
(4)   Tunnel-Type = VLAN
(4)   Tunnel-Medium-Type = IEEE-802
(4)   Mikrotik-Wireless-VLANID = 10
(4)   Mikrotik-Wireless-Comment = "User1"
(4)   Mikrotik-Wireless-Forward = 1
(4)   Mikrotik-Wireless-VLANID-Type = 0
(4) Finished request 

DEFAULT         Cleartext-Password := "%{User-Name}"
                        Tunnel-Type = VLAN,
                        Tunnel-Private-Group-ID := 99,
                        Tunnel-Medium-Type = IEEE-802,
                        Mikrotik-Wireless-VLANID := 99,
                        Mikrotik-Wireless-Comment = "unknown",
                        Mikrotik-Wireless-Forward := 1,
                        Mikrotik-Wireless-VLANID-type := 0,
                        Reply-Message := "Hello %{User-Name}, Wenden sie sich an den Admin !"
# 

if (!"%{sql:SELECT * FROM radcheck WHERE Username = '%{User-Name}'}"){  
    update reply {
        &Tunnel-Type := VLAN
        &Tunnel-Private-Group-ID := 999
        &Tunnel-Medium-Type := IEEE-802        
        &Mikrotik-Wireless-VLANID := 999
        &Mikrotik-Wireless-Comment := "unknown"  
        &Mikrotik-Wireless-Forward := 1
        &Mikrotik-Wireless-VLANID-type := 0                          
    }
    update control {
        Auth-Type := Accept
    }
}