MACアドレス認証構築_HP2530編

## 環境
* Radiusサーバー情報
  * VMware ESXi 11
  * CentOS Linux 7.4.1708
  * freeradius-3.0.13-8.el7_4.x86_64
  * freeradius-utils-3.0.13-8.el7_4.x86_64
  * 192.0.2.1

* RadiusClient情報
  * HP2530 YB.16.10.0011
  * 192.0.2.2

* 端末
  * ノートPC
  * MAC:xx-xx-xx-yy-yy-yy  


# RadiusServer設定
下記参考↓

https://qiita.com/motimotinoyamayama/items/ed9778ce8a50e449d853

# HP2530MAC認証設定

認証許可された端末に割り当てるVLAN設定
```
(config)# configure
(config)# vlan 15 name Radis
```

インターフェースコンテキストでVLANを指定。
```
(config)# interface 2
(eth-2)# untagged vlan 15 
(eth-2)# exit
```

Radiusサーバを指定。keyは/etc/raddb/clientで指定した値。
```
(config)# radius-server host 10.180.198.69 key radiusstring
```

802.1x認証方式の設定
```
(config)# aaa authentication port-access chap-radius
```

ポート単位のMACアドレス認証有効化
```
(config)# aaa port-access mac-based 2
```

承認ClientVLAN指定
```
(config)# aaa port-access mac-based 2 auth-vid 15
```
設定保存
```
(config)# save
```

# 設定の確認
```php:# show running-config 

dhcp-snooping
dhcpv6-snooping
radius-server host 192.0.2.1
time timezone 540
snmp-server community "public"
aaa authentication port-access chap-radiusaaa
aaa port-access mac-based 2
aaa port-access mac-based 2 auth-vid 15
vlan 1
   name "DEFAULT_VLAN"
   no untagged 1-2
   untagged 3-28
   ip address dhcp-bootp
   exit
vlan 15
   name "Radius"
   untagged 2
   no ip address
   exit
vlan 40
   name "hoge"
   untagged 1
   ip address 192.0.2.2 255.255.255.0
   exit
no tftp server
no dhcp config-file-update
no dhcp image-file-update
no dhcp tr69-acs-url
```

# MAC認証後の確認
HP2530のshowコマンド
```php:# show logging 
 Keys:   W=Warning   I=Information
         M=Major     D=Debug E=Error
----  Event Log listing: Events Since Boot  ----
I 04/12/23 16:11:14 00184 mgr: Log cleared as a result of  'clear logging' 
            command
I 04/12/23 16:14:38 03125 mgr: Startup configuration changed by CLI.  New seq.
            number 3

I 04/17/23 11:12:14 00002 vlan: Radius virtual LAN disabled
I 04/17/23 11:12:14 00001 vlan: Radius virtual LAN enabled
```

```php:# show port-access mac-based clients 

 Port Access MAC-Based Client Status

  Port  MAC Address   IP Address                       Mode Client Status       
  ----- ------------- -------------------------------- ---- --------------------
  2     xxxxxx-yyyyyy n/a                              User authenticated       
```

以下はRadiusServerでの操作
```php:$ sudo cat /var/log/radius/radius.log | tail -5
Mon Apr 17 11:02:27 2023 : Info:  # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:330Mon Apr 17 11:02:27 2023 : Info: Loaded virtual server inner-tunnel
Mon Apr 17 11:02:27 2023 : Info: Ready to process requests
Mon Apr 17 11:02:46 2023 : Auth: (0) Login OK: [xxxxxxyyyyyy/<CHAP-Password>] (from client HP2530 port 2 cli xx-xx-xx-yy-yy-yy)
Mon Apr 17 11:09:53 2023 : Auth: (1) Login OK: [xxxxxxyyyyyy/<CHAP-Password>] (from client HP2530 port 2 cli xx-xx-xx-yy-yy-yy)
```

```php:$ sudo tcpdump -li ens160 port 1812
tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on ens160, link-type EN10MB (Ethernet), capture size 262144 bytes
11:19:05.516817 IP 192.0.2.2.radius > localhost.localdomain.radius: RADIUS, Access-Request (1), id: 0x69 length: 330
11:19:05.517584 IP localhost.localdomain.radius > 192.0.2.2.radius: RADIUS, Access-Accept (2), id: 0x69 length: 36
```

# 認証拒否の対処方法
認証すると Auth: (17) Login incorrect (chap: &control:Cleartext-Password is required for authentication): [xxxxxxyyyyyy/<CHAP-Password>] (from client HP2530 port 2 cli xx-xx-xx-yy-yy-yy) と拒否される 
/etc/raddb/usersの181行目から183行目にマッチしていたので、認証拒否されていた。コメントアウトすることで、認証成功した。
```$ sudo vi /etc/raddb/users
181 #DEFAULT        Framed-Protocol == PP
182 #       Framed-Protocol = PPP,
183 #       Framed-Compression = Van-Jacobson-TCP-IP
```