search

inverse-inc / packetfence

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, powerful BYOD management options, 802.1X support, layer-2 isolation of problematic devices; PacketFence can be used to effectively secure networks small to very large heterogeneous networks.
https://packetfence.org
GNU General Public License v2.0
1.29k stars 274 forks source link

RADIUS Disconnect-Request for Mikrotik Routers is wrong attribute #7703

Open bmday opened 1 year ago

bmday commented 1 year ago

Packetfence v 12.2.0 ISO Mikrotik RB951G-2HnD RouterOS v7.9.2

Describe the bug When situations arise in Packetfence with the Mikrotik type and CoA \ Disconnect is enabled for it, the disconnect request is not processed correctly by the Mikrotik router. This is because packetfence sends the attribute User-Name="MAC-address in upper case" by default. In this regard, the Mikrotik router does not disconnect the hotspot client, but the client device from the wireless interface, because it compares the received MAC address with the MAC address table.

To Reproduce Preconditions for reproduction: The Mikrotik RB951G-2HnD RouterOS v7.9.2 router is configured as Hotspot according to the Packetfence Network Devices Configuration Guide documentation in WebAuth mode (https://www.packetfence.org/doc/PacketFence_Network_Devices_Configuration_Guide.html#_webauth_3) Accounting for Packetfence and Mikrotik must be enabled and configured according to the official documentation.

On Packetfence GUI:

  1. Go to the Nodes page and select one of the nodes.
  2. Run the Deregister command on the selected node.

Screenshots image

Expected behavior A valid disconnect request must contain the Framed-IP-Address attribute. Even this attribute alone will be enough for the Mikrotik router to disconnect the client from its Hotspot and stop providing services to it. This means that the client device will only reconnect to the access point, and the provision of services will not stop.

BiasF commented 3 months ago

I can confirm that CoA & Radius-Disconnect is not working on Mirkotik together with packetfence. I would be happy if that would be fixed :)