We have multiple AP's at work with same SSID.
device mac-auth is controlled by daloradius server which is working fine.
I want to use access-list to remove wireless devices with weak signal.
The issue is that when i setup access-list then router ignores radius server and any device with password can connect.
My question is how can i use access-list together with radius server.
I want to be able to remove device with weak signal but still want them to use radius for mac auth.
Thank you
Re: access-list + radius not working.
Can you post your ACL configuration?
Re: access-list + radius not working.
/interface wireless access-list
add signal-range=-85..120
add authentication=no forwarding=no
add signal-range=-85..120
add authentication=no forwarding=no
Re: access-list + radius not working.
That's ... not a lot.
Is your ACL set to reject the clients with signal in the range -85..-120?
I created one (using wifi, not wireless) - here is what it looks like.
The second "add", is it an ACL?
Is your ACL set to reject the clients with signal in the range -85..-120?
I created one (using wifi, not wireless) - here is what it looks like.
Code: Select all
/interface wifi access-list
add action=reject disabled=no signal-range=-85..120
Re: access-list + radius not working.
Yes if it falls below that thresholds then device will be disconnected after 10 seconds.
Th issue im facing is that radius does not have control when rules is enabled. In the logs it will show radius rejected device but then acl will allow the same device.
Th issue im facing is that radius does not have control when rules is enabled. In the logs it will show radius rejected device but then acl will allow the same device.
Re: access-list + radius not working.
My settings are a bit different, your range is incorrect:
Anything above -90 is accepted, anything below rejected.
Your current range is from -80 to 120, which is the range you would probably like to accept.
Code: Select all
/interface wifi access-list
add action=accept allow-signal-out-of-range=10s disabled=no signal-range=-90..0
add action=reject allow-signal-out-of-range=10s disabled=no signal-range=-120..-91Your current range is from -80 to 120, which is the range you would probably like to accept.
Last edited by erlinden on Tue Jan 30, 2024 11:55 am, edited 2 times in total.
Re: access-list + radius not working.
Can you modify your ACL to the following?
This means that the clients with signal -65..0 are accepted but when the signal dips under -65, they are disconnected.
The way your ACL was written meant: "if a client has a signal in the range -85..120, okay, otherwise disconnect"
This means that the clients with signal -65..0 are accepted but when the signal dips under -65, they are disconnected.
Code: Select all
/interface wireless access-list
add signal-range=-65..0
add authentication=no forwarding=no signal-range=-120..-66
Re: access-list + radius not working.
I am reading the page on interface/wireless, specifically the section on Radius MAC authentication
Provided you have radius-mac-authentication=yes set, something like this should then be used:
That will drop whatever is out of signal and the rest will have to go through radius.
If I understand that correctly - unfortunately I no longer have an old-style wifi device to test - whatever is not matched by the ACL goes to MAC auth: so if accepted -> no MAC auth, if rejected -> no MAC auth.RADIUS MAC authentication
Note: RADIUS MAC authentication is used by access point for clients that are not found in the access-list, similarly to the default-authentication property of the wireless interface. It controls whether client is allowed to proceed with authentication, or is rejected immediately.
When radius-mac-authentication=yes, access point queries RADIUS server by sending Access-Request with the following attributes:
User-Name - Client MAC address. This is encoded as specified by the radius-mac-format setting. Default encoding is "XX:XX:XX:XX:XX:XX".
Nas-Port-Id - name of wireless interface.
User-Password - When radius-mac-mode=as-username-and-password this is set to the same value as User-Name. Otherwise this attribute is empty.
Calling-Station-Id - Client MAC address, encoded as "XX-XX-XX-XX-XX-XX".
Called-Station-Id - MAC address and SSID of the access point, encoded as "XX-XX-XX-XX-XX-XX:SSID" (minus separated pairs of MAC address digits, followed by colon, followed by SSID value).
Acct-Session-Id - Added when radius-mac-accounting=yes.
Provided you have radius-mac-authentication=yes set, something like this should then be used:
Code: Select all
/interface wireless access-list
add authentication=no forwarding=no signal-range=-120..-66
-
-
snuggerbonzen
just joined
- Posts: 11
- Joined:
Re: access-list + radius not working.
We have multiple AP's at work with same SSID.
device mac-auth is controlled by daloradius server which is working fine.
Could you share the relevant capsman and caps configs that make this work? I am trying to achieve the same, but so far I only got auth and vlan assignment working with EAP, but not for mac auth.
Re: access-list + radius not working.
Im not using capsman but have setup access list on each router.We have multiple AP's at work with same SSID.
device mac-auth is controlled by daloradius server which is working fine.
Could you share the relevant capsman and caps configs that make this work? I am trying to achieve the same, but so far I only got auth and vlan assignment working with EAP, but not for mac auth.
Re: access-list + radius not working.
I am reading the page on interface/wireless, specifically the section on Radius MAC authentication
If I understand that correctly - unfortunately I no longer have an old-style wifi device to test - whatever is not matched by the ACL goes to MAC auth: so if accepted -> no MAC auth, if rejected -> no MAC auth.RADIUS MAC authentication
Note: RADIUS MAC authentication is used by access point for clients that are not found in the access-list, similarly to the default-authentication property of the wireless interface. It controls whether client is allowed to proceed with authentication, or is rejected immediately.
When radius-mac-authentication=yes, access point queries RADIUS server by sending Access-Request with the following attributes:
User-Name - Client MAC address. This is encoded as specified by the radius-mac-format setting. Default encoding is "XX:XX:XX:XX:XX:XX".
Nas-Port-Id - name of wireless interface.
User-Password - When radius-mac-mode=as-username-and-password this is set to the same value as User-Name. Otherwise this attribute is empty.
Calling-Station-Id - Client MAC address, encoded as "XX-XX-XX-XX-XX-XX".
Called-Station-Id - MAC address and SSID of the access point, encoded as "XX-XX-XX-XX-XX-XX:SSID" (minus separated pairs of MAC address digits, followed by colon, followed by SSID value).
Acct-Session-Id - Added when radius-mac-accounting=yes.
Provided you have radius-mac-authentication=yes set, something like this should then be used:
That will drop whatever is out of signal and the rest will have to go through radius.Code: Select all/interface wireless access-list add authentication=no forwarding=no signal-range=-120..-66
Thank you. It seems to be working after trying your suggestion.
Who is online
Users browsing this forum: cyrq and 16 guests