Junos OS

 View Only
last person joined: 13 hours ago 

Ask questions and share experiences about Junos OS.
  • 1.  RADIUS - Change NAS-Port format to logical interface name and not index.

    Posted 08-24-2022 07:52

    Hello experts!

    I've been tasked with gathering information about on how many users are in each site/building and i've been using our WS NPS logs for this task.

    Now i want to take it one step further and also collect information about which physical interface they are on and VC member.

    When a user is authenticated with dot1x a log message appears with following information about the switch, current port information marked in red.

    This is the logical index of the interface and not it's logical interface name, on the switch:

    I'm aware that the switch does send the logical interface name in RADIUS option 87, but windows NPS doesn't log this information in the event viewer:

    Is there anyway to configure so that the logical interface name gets included in Radius Option 5 (NAS-port) on the juniper? I've looked trough the documentation but all i can see is ways to edit radius option 87 (NAS-Port-Id).

    I'm aware of the syslog option 'deamon info' that sends information about dot1x but i would prepare if i could continue to use the logs from the NPS servers as they also contains logs from Wi-Fi.

    DOT1x logs from 'deamon info':

    Best regards 

    Andreas



    ------------------------------
    Andreas
    ------------------------------


  • 2.  RE: RADIUS - Change NAS-Port format to logical interface name and not index.
    Best Answer

    Posted 08-25-2022 06:19
    Hi Andreas,

    according to section 5.5 of RFC 2865 attribute 5 is a number only (no bigger than 32 bits).  So it's impossible to use that attribute to convey the text name of the interface.

    Scott

    ------------------------------
    SCOTT AITKEN
    ------------------------------



  • 3.  RE: RADIUS - Change NAS-Port format to logical interface name and not index.

    Posted 08-25-2022 09:50

    Hi Scott,

    Thanks for the information,  i guess it's makes a lot more sense then in given that you can  at least investigate the port in question afterwards.



    ------------------------------
    Andreas
    ------------------------------



  • 4.  RE: RADIUS - Change NAS-Port format to logical interface name and not index.

    Posted 10-19-2022 03:01

    To summarize, what i did was collect the logs instead with following config:

     
    host <syslog-host>{
        any notice;
        daemon info;
        interactive-commands any;
    }
    This allows for building complex solutions and togheter with the patchpanel information we monitor user activity on each floor and floor "site".


    ------------------------------
    Andreas
    ------------------------------