FreeRADIUS Integration

Adding FreeRADIUS integration to VMware Edge Network Intelligence allows you to see the specific RADIUS authentication messages related to a devices network authentication. Without this integration RADIUS messages are not decoded and can only report the success or failure of an authentication request. This integration is accomplished by adding the crawler as a syslog logging target.

Minimum Supported Radius: 3.0.15

You can run radiusd -v to check the version of your freeradius.

Step 1:

Edit the Radius configuration file "radiusd.conf" as shown:

#logdir replace "/var/log/freeradius" by "syslog"
${localstatedir}/log/radius

Under log settings:
#destination - replace "files" by "syslog"
destination = syslog

#default is daemonsys
log_facility = daemon
stripped_names = no

#Log authentication requests to the log file.
auth = yes

#Audit password if it's rejected.
auth_badpass = no

#Audit password if it's correct.
auth_goodpass = no 

Add the format for msg_goodpass and msg_badpass as follows:
For Aruba:
 
msg_goodpass = "CallingStationId=%{Calling-Station-Id}, CalledStationId=%{Called-Station-Id}, ESSID=%{Essid-Name}, APName=%{AP-Name}, Subject=%{TLS-Client-Cert-Subject}"

msg_badpass = "CallingStationId=%{Calling-Station-Id}, CalledStationId=%{Called-Station-Id}, ESSID=%{Essid-Name}, APName=%{AP-Name}, Subject=%{TLS-Client-Cert-Subject}" 

For Cisco:
msg_goodpass = "CallingStationId=%{Calling-Station-Id}, CalledStationId=%{Called-Station-Id}"

msg_badpass = "CallingStationId=%{Calling-Station-Id}, CalledStationId=%{Called-Station-Id}" 

Note - We support the following formats for CalledStationId - 
MAC address of the Access Point 
AP Name with ESSID separated by a colon, AP-name:ESSID

Step 2: Restart FreeRADIUS

If you're running Debian Linux or Ubuntu Linux:
/etc/init.d/freeradius restart

If you're running Red Hat Enterprise Linux service:
radiusd restart

If you're running FreeBSD operating system:
/etc/rc.d/radiusd restart

Step 3 Edit /etc/rsyslog.conf file and add the following

#Enable UDP module
$ModLoad imudp
$UDPServerRun 514
#FreeRADIUS log
daemon.* @<crawler_ip> 

Step 4 Restart Rsyslog

If you're running Debian Linux or Ubuntu Linux:
/etc/init.d/rsyslog restart

If you're running Red Hat Enterprise Linux:
service rsyslog restart

If you're running FreeBSD operating system:
/etc/rc.d/syslogd restart